CVE-2026-29519 PUBLISHED

Lucee CFML Server Reflected XSS via URL Path Parsing

Assigner: VulnCheck
Reserved: 04.03.2026 Published: 10.07.2026 Updated: 10.07.2026

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads within the request path. Attackers can craft a malicious URL containing injected script content that is reflected in the server's response without proper output encoding, enabling session hijacking or unauthorized actions against the Lucee administrative interface when a victim visits the crafted link.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
CVSS Score: 6.2

Product Status

Vendor lucee
Product Lucee
Versions Default: affected
  • affected from 5.3.1.95 to 7.0.0.395 (incl.)

Credits

  • Fouad Milat (lavado) finder
  • VulnCheck finder

References

Problem Types

  • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE