CVE-2005-4074: Directory traversal vulnerability in index.cfm in CF_Nuke 4.6 and earlier, when Sandbox Security is disable...

Security readout for executives and security teams

CF_Nuke 4.6 and earlier can let a remote attacker make the site include local ColdFusion files when Sandbox Security is disabled. This is mainly a legacy exposure concern: organizations should verify whether CF_Nuke is still present and whether old public ColdFusion routes remain reachable. Exposure is likely limited to legacy CF_Nuke 4.6 or earlier installations with public index.cfm access and Sandbox Security disabled. Asset inventories may miss this because the affected product metadata is incomplete in the provided CVE record. Treat this as a legacy technology risk requiring inventory and containment rather than an emergency based on current evidence. Prioritize any internet-facing ColdFusion system running CF_Nuke because the vulnerable condition is remotely reachable when sandboxing is disabled. Mitigation focus: Inventory for CF_Nuke 4.6 or earlier, including abandoned ColdFusion directories.; Enable ColdFusion Sandbox Security where CF_Nuke remains deployed.; Check vendor or archived project guidance for any available fixed release..

Prepared

Jun 29, 2026, 16:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.