CVE-2026-29519

Name of the Vulnerable Software and Affected Versions Lucee CFML Server versions 5.3.x Lucee CFML Server versions 6.1.x Lucee CFML Server versions 6.2.x Lucee CFML Server versions 7.0.x

Description Reflected cross-site scripting occurs during URL path parsing, allowing unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser. This is achieved by embedding HTML or JavaScript payloads within the request path, which the server reflects in the response without proper output encoding. This flaw can lead to session hijacking or unauthorized actions against the administrative interface. Real-world incidents of elevated activity targeting this issue have been observed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.