We are pleased to announce that we have released the updates for the following ColdFusion versions:
The following are links to the tech notes for each update:
The releases address security vulnerabilities, which are documented in the bulletin APSB19-14.
In these updates, we have also introduced the following:
- A new application setting blockedExtForFileUpload to specify a comma-separated list of file extensions for file that must be blocked for uploading.
- In the ColdFusion Administrator, in Server Settings > Settings, there are is an option Blocked file extensions for CFFile uploads. Specify a comma-separated list of file extensions, which will be blocked from being uploaded by the cffile tag/functions.
- The Admin API, setRuntimeProperty has a new property, BlockedExtForFileUpload. The values are a comma-separated list of file extensions to restrict file uploading of the appropriate files.
For more information, see the tech notes and the tag/function documentation.
.png)
.png)
.png)
SauravGhosh – when you guys add security features like this in an update are you also updating the Server Auto-Lockdown installer to include them? (I realize this only applies to ColdFusion 2018)
Be aware CF11 hf 16 (up to and including hf 18) break URLEncodedFormat and builtin encoding such as in cfhttpparam, because it refuses to double encode anything. This will likely break things passing a previously encoded value. (I first noticed the problem as an oauth signature calculated over a return URL failed.)
I found an existing bug report: https://tracker.adobe.com/#/view/CF-4204045
Hello,
The checksum is not correct via https://helpx.adobe.com/coldfusion/kb/coldfusion-11-updates.html
489fdb288d73136b50d5f27993c981fa
It’s not the same as in https://cfdownload.adobe.com/pub/adobe/coldfusion/xml/updates.xml
8270f3d08054e87fb24d4dad7c0cacda
We are talking about a (security) patching, you should really improve your internal check
You must be logged in to post a comment.
22 Sep 2025
Las Vegas, NV
