Whatever message this page gives is out now! Go check it out!
ColdFusion (2025 release) Update 5
Last update:
May 18, 2026
ColdFusion (2025 release) Update 5 tech note
Security recommendations
For all security updates, Adobe recommends applying the security configuration settings outlined on the ColdFusion Security page and reviewing the respective Lockdown guides.
Note:
The updates below are cumulative and contain all updates from previous ones. If you are skipping updates, you can apply the latest update, not those you are skipping. Further, you must take note of any changes that are implemented in each of the updates you are skipping.
View ColdFusion (2025 release) Updates for more information.
What's new and changed
ColdFusion (2025 release) Update 5 (release date, 9 December 2025) includes important security fixes that mitigate vulnerabilities related to arbitrary file system write, arbitrary file system read, arbitrary code execution, and security feature bypass. The update also upgrades the underlying Tomcat engine to version 10.1.48.0.
View the security bulletin, APSB25-105, for more information.
Note:
If you have added custom entries to the pathfilter.json file, you must either:
- Back up the pathfilter.json file before applying the update, or
- Restore it from the update backup after applying the update.
The backup copy of the file can be found at: hf-updates\hf-2025-00005-331552\backup\lib\pathfilter.json
New JVM flags
- -Dcoldfusion.websocket.selector.validation
- -Dcoldfusion.deserialization.safeguard.enabled
- -Dcoldfusion.pdf.ddx.allowExternalEntities
- Renamed -Dcoldfusion.datasource.blocked.properties to -Dcoldfusion.datasource.allowed.properties
See JVM arguments in ColdFusion (2025 release) for more information.
Changes to serialfilter
ColdFusion blocks all class deserialization by default.
From this update, ColdFusion blocks all class deserialization by default. ColdFusion applies a default‑deny deserialization policy using an internal allowlist of classes required by the platform and the cfusion/lib/serialfilter.txt file, which you can edit to whitelist additional safe classes or packages. Classes not on this allowlist are blocked, and an error is logged advising you to add the relevant class or package to serialfilter.txt if you wish to allow it.
When a class is blocked, ColdFusion logs a clear message in both server.log and exception.log, for example:
Error","http-nio-8502-exec-1","11/12/25","11:34:20","", "Due to security reasons, java.util.HashMap is blocked for deserialization. Add the class/package in the file cfusion/lib/serialfilter.txt to override the behavior and allow deserialization."
Error","http-nio-8502-exec-1","11/12/25","11:34:20","", "Due to security reasons, java.util.HashMap is blocked for deserialization. Add the class/package in the file cfusion/lib/serialfilter.txt to override the behavior and allow deserialization."
In case you want to debug further, the stack trace will be in exception.log
If required for backward compatibility or troubleshooting, you can temporarily restore the previous, less restrictive behaviour by setting -Dcoldfusion.deserialization.safeguard.enabled=false. This option is intended only for non-production use and is not recommended for production environments.
Earlier in JEE deployments, the serialfilter.txt file was not functioning, and administrators had to rely on the -Djdk.serialFilter JVM option instead. This limitation has been addressed, and serialfilter.txt is now functional in JEE deployments. If both configurations are present, the -Djdk.serialFilter setting continues to take precedence over serialfilter.txt.
CAR migration changes
ColdFusion Archive (CAR) creation and deployment now honor path allow‑lists defined in <cf_home>/cfusion/lib/pathfilter.json.
- CAR deployment (car.deploypath)By default, no CAR file can be deployed from any path.
- The source paths from which CAR files may be deployed must be explicitly whitelisted under the car.deploypath key in pathfilter.json.
- If a CAR is deployed from a non‑whitelisted path, deployment fails and an error is logged in car_deploy.log, for example:"Error","","10/29/25","10:14:41","","The path \\localhost\c$\new12.car is not whitelisted in pathfilter."
- CAR creation (car.associatedfiles)
- Files and directories included in a CAR as “Associated Files/Dirs” are now checked against the car.associatedfiles allow‑list in pathfilter.json.
- Non‑whitelisted files/directories are skipped when building the CAR and are logged in car_archive.log.
- The CAR build still completes, but unsafe or non‑allowed content is not bundled.
Configuration format
To configure allowed paths for CAR operations, use the following structure in pathfilter.json:
"car": {
"deploypath": "",
"associatedfiles": ""
}You can also deploy CARs from shared locations, as long as those locations are explicitly listed in car.deploypath.
New Tomcat version
The update includes a new version of Tomcat, v10.1.48.0.
Bugs fixed in the update
| Bug ID | Description | Component |
| CF-4227542 | cfindex could no longer index .docx (and .xlsx) files in ColdFusion (2025 release) after the July 2025 updates, due to a breaking POI/XMLBeans upgrade, producing errors like “Cannot resolve type for handle … code 13”. | Solr |
| CF-4227360 | After the July 2025 updates, the ColdFusion mail package developed an OSGi/Felix-cache–sensitive bug where cfmail would start failing (often after restarts) with mail-signing/crypto errors. | Mail package |
| CF-4224509 | Mail signing (cfmail with signing enabled via Admin keystore) failed in ColdFusion due to classloader conflicts in BouncyCastle, causing a ClassCastException between X500Name and ASN1Encodable during S/MIME signing. All signed mails ended up in Undelivered, and the only workaround was to turn off signing. | Mail package |
| CF-4225874 | The val() function started returning a value that evaluated as true in boolean contexts, even for val("") and val(0), which should logically behave like numeric zero and thus be false. | Language |
| CF-4227842 | Running the ColdFusion 2025 Lockdown Installer failed midway through, with a StringIndexOutOfBoundsException in its script‑source parsing logic. As a result, the lockdown could not complete, and ColdFusion services were left running as Administrator instead of using the lockdown user. | Lockdown installer |
| CF-4227841 | On the previous update, the Export PDF button on the Licensing & Activation > Usage page did not work as expected. Clicking it produced a client‑side error (EncodeForJavaScript is not defined) and did not generate a PDF. | Administrator |
| CF-4227528 | After applying the previous update, existing clustered scheduled tasks stored in a database stopped working: they no longer displayed correctly in CF Admin (showing errors such as 'ISVALIDPUBLISHPATH is undefined') | Scheduler |
| CF-4227343 | Using createObject() to load certain Java classes from CF packages (e.g., Document/PDF’s dependency jars) caused the Document and PDF packages to silently roll back to the base version. | Administrator package |
| CF-4226953 | On ColdFusion 2021 and 2025 servers with multiple instances, the HTML to PDF (PDFg) service worked for only one instance at a time. The instance that most recently had its PDFg service updated could generate PDFs via htmltopdf, while other instances returned blank pages. Reconfiguring PDFg for a second instance made that instance work but broke the first, making multi‑instance cfhtmltopdf usage unreliable. | HTMLToPDF package |
Known issues in the update
cfpdf
The cfpdf tag’s archive action currently fails when targeting the PDF/A‑2b standard. Attempts to archive PDFs to PDF/A‑2b can throw a NullPointerException in the internal metadata processing instead of completing successfully.
Serialization
In this update, the deserialization safeguard can affect two areas:
- First, on ColdFusion 2021 running with an older Java 11 build, logging of blocked deserialization does not work correctly (you may see warnings that ObjectInputFilter is not available), so you should run on Java 11.0.28 and later to get proper error logging.
- Second, for security reasons, we have blocked java.io.Serializable by default, which may affect features such as ORM, Hibernate, or EhCache. If you see error, such as,
"Due to security reasons, java.io.Serializable; is blocked for deserialization. Add the class/package in the file cfusion/lib/serialfilter.txt to override the behavior and allow deserialization.", check the exception.log and add the necessary class/package in cfusion/lib/serialfilter.txt.
Behavior changes
To address scope injection vulnerability, ColdFusion has updated scope precedence to protect non-user-controlled scopes. For a complete list of reserved words in CFML, see Reserved words and reserved variable names in ColdFusion.
Prerequisites
- On 64-bit computers, use 64-bit JRE for 64-bit ColdFusion.
- If the ColdFusion server is behind a proxy, specify the proxy settings for the server to get the update notification and download the updates. Specify proxy settings using the system properties below in the jvm.config for a stand-alone installation, or corresponding script file for JEE installation.
- http.proxyHost
- http.proxyPort
- http.proxyUser
- http.proxyPassword
- For ColdFusion running on JEE application servers, stop all application server instances before installing the update.
ColdFusion JDK flag requirements
COLDFUSION 2025 (version 2025.0.0.331385)
For Application Servers
- Apache Tomcat Application Server: edit JAVA_OPTS in the ‘Catalina.bat/sh’ file
- WebLogic Application Server: edit JAVA_OPTIONS in the ‘startWeblogic.cmd’ file
- WildFly/EAP Application Server: edit JAVA_OPTS in the ‘standalone.conf’ file
Set the JVM flags on a JEE installation of ColdFusion, not on a standalone installation.
Installation
ColdFusion Administrator
In Package Manager > Packages, click Check for Updates in Core Server.
After it detects an update, click Update. The core package gets updated the the latest update.
All installed packages also get updated.
Restart ColdFusion for the changes to take effect.
Install the update in offline mode manually
- Download the hotfix installer from the link.
- Download the packages zip file from this link and extract its contents to a location accessible to all ColdFusion server instances.
- Update "packagesurl" in cfusion/lib/neo_updates.xml of cfusion and all its child instances to point to <InstallerRepositoryUnzippedPath>/bundles/bundlesdependency.json present inside the downloaded folder.
You must have privileges to start or stop ColdFusion service and full access to the ColdFusion root directory.
- Windows:<cf_root>\jre\bin\java.exe -jar <InstallerRepositoryUnzippedPath>\bundles\updateinstallers\hotfix-005-331552.jar
- Linux-based platforms:<cf_root>/jre/bin/java -jar <InstallerRepositoryUnzippedPath>/bundles/updateinstallers/hotfix-005-331552.jar
If the core server hotfix installation is successful and if there are errors or issues with packages, packages can be installed/updated from the package manager client(cfusion\bin\cfpm.bat|cfpm.sh).
Ensure that the JRE bundled with ColdFusion is used for executing the downloaded JAR. For standalone ColdFusion, this must be at, <cf_root>/jre/bin.
Install the update from a user account that has permissions to restart ColdFusion services and other configured webservers.
For further details on manually updating the application, see the help article.
Post installation
Note:
After applying this update, the ColdFusion build number should be 2025,0,05,331552
Uninstallation
To uninstall the update, perform one of the following:
- In ColdFusion Administrator, click Uninstall in Server Update > Updates > Installed Updates.
- Run the uninstaller for the update from the command prompt. For example, java -jar {cf_install_home}/{instance_home}/hf_updates/hf-2025-00005-331552/uninstall /uninstaller.jar
If you can't uninstall the update using the above-mentioned uninstall options, the uninstaller could be corrupted. However, you can manually uninstall the update by doing the following:
- Delete the update jar from {cf_install_home}/{instance_name}/lib/updates.
- Copy all folders from {cf_install_home}/{instance_name}/hf-updates/{hf-2025-00005-331552}/backup directory to {cf_install_home}/{instance_name}/
Note:
Uninstalling this update only removes the core update itself. Any ColdFusion packages that were updated as part of this release remain at their latest compatible versions. If you need to revert package versions, you must do so separately; uninstalling the core update does not roll back package versions automatically.
Frequently asked questions
If I uninstall ColdFusion 2025 Update 5, will all the packages installed with it be rolled back?
No. Package rollback depends on the minimum core dependency of each package:
- Packages with a minimum core dependency of update 5 (that is, they specifically require this core level) are rolled back when you uninstall this core update.
- Packages with a minimum core dependency of Update 3 or Update 4 remain installed at their latest compatible versions and are not automatically rolled back when you uninstall the core update.
Connector configuration
Package updates
| 2025 Update | Packages updated |
| Update 5 | Yes
|
| Update 4 | Yes
|
| Update 3 | The following packages are updated:
|
| Update 2 | The following packages are updated:
|
| Update 1 | The following packages are updated:
|
Revision history
- 19 Dec 2025: To address scope injection vulnerability, ColdFusion has updated scope precedence to protect non-user-controlled scopes. For a complete list of reserved words in CFML, see Reserved words and reserved variable names in ColdFusion.
We're glad. Tell us how this page helped.
We're sorry. Can you tell us what didn't work for you?
Share additional feedback to help us improve.
0/255
|
