CVE-2026-29519: Lucee CFML Server Reflected XSS in URL Path Parsing

Technical summary

CVE-2026-29519 is a reflected cross-site scripting (XSS) vulnerability in URL path parsing affecting Lucee CFML Server versions 5.3.x, 6.1.x, 6.2.x, and 7.0.x. The vulnerability stems from insufficient output encoding when processing URL path components in server responses. An unauthenticated attacker can embed HTML or JavaScript payloads within the request path; these payloads are reflected back without sanitization, allowing arbitrary script execution in the browser context of any user who visits the malicious URL. The CVSS 3.1 score of 8.2 (HIGH) reflects the network-based attack vector, low complexity, absence of privilege requirements, requirement for user interaction, and changed scope—with high confidentiality and limited integrity impact.

Business impact

Organizations running Lucee CFML Server face risk of unauthorized access to sensitive administrative functions if attackers successfully exploit this vulnerability. Session hijacking becomes possible if admin credentials or session tokens are captured via the XSS payload. Additionally, attackers could perform unauthorized configuration changes, deploy backdoors, or exfiltrate sensitive application data. The business impact depends on what sensitive systems or data are accessible through the compromised Lucee instance and the administrative panel.

Affected systems

Lucee CFML Server versions 5.3.x, 6.1.x, 6.2.x, and 7.0.x are vulnerable. Organizations should identify all instances of Lucee in their environment across these version lines. Both on-premises and cloud-hosted Lucee deployments may be affected if they are exposed to untrusted network traffic or if users can be directed to attacker-controlled URLs.

Exploitability

Exploitability is moderate to high. The attack requires user interaction—a victim must click or be redirected to a crafted URL—but no special technical prerequisites or authentication are needed. The attacker can use common social engineering tactics (phishing, malicious links in forums, advertisements, etc.) to distribute the payload. Once a user visits the malicious URL, the JavaScript executes automatically in their browser with the privileges of that user.

Remediation

Apply security patches provided by Lucee for the affected version lines. Verify patch availability and compatibility with your deployment. Until patching is complete, implement network-level controls such as Web Application Firewalls (WAF) configured to detect and block reflected XSS patterns in URL paths targeting Lucee instances. Additionally, restrict administrative interface access to trusted IP ranges and consider requiring multi-factor authentication for admin login as an interim defense.

Patch guidance

Contact Lucee or consult their official security advisories to obtain patched versions for the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines. Before deploying patches, test them in a non-production environment to ensure compatibility with your applications. Prioritize patching production Lucee instances exposed to the internet or accessible by untrusted users. Verify against the vendor advisory that the patch you apply addresses CVE-2026-29519 specifically.

Detection guidance

Monitor access logs for suspicious URL patterns containing HTML or JavaScript entities (e.g., %3Cscript%3E, <script>, javascript:, onerror=, onload=) in the request path targeting Lucee endpoints. Implement network-based detection rules in your WAF or IDS/IPS to flag reflected XSS payloads. Endpoint Detection and Response (EDR) tools can identify unusual JavaScript execution originating from browser processes following clicks on suspicious links. Log analysis should correlate admin panel access with anomalous request paths or multiple failed authentication attempts.

Why prioritize this

This vulnerability merits high priority due to its HIGH CVSS score (8.2), lack of authentication requirements, wide applicability across multiple Lucee version lines, and direct exposure of administrative interfaces. While user interaction is required, the ease of social engineering and the potential for unauthorized admin access justify rapid patching. Organizations should address this before medium-severity vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects a network-accessible vulnerability with low attack complexity and no privilege requirements, balanced slightly by the user interaction requirement. The 'changed scope' designation indicates the impact extends beyond the vulnerable component to other systems (browser, admin panel, authenticated sessions). High confidentiality impact accounts for potential session token theft; limited integrity impact reflects possible unauthorized actions. Absence of availability impact prevents a critical rating.

Frequently asked questions