Lucee CFML Server Reflected XSS in URL Path Parsing

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads within the request path. Attackers can craft a malicious URL containing injected script content that is reflected in the server's response without proper output encoding, enabling session hijacking or unauthorized actions against the Lucee administrative interface when a victim visits the crafted link.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Lucee CFML Server versions 5.3.x, 6.1.x, 6.2.x, and 7.0.x contain a reflected cross-site scripting (XSS) vulnerability in URL path parsing that allows unauthenticated attackers to inject arbitrary JavaScript into victim browsers. By crafting malicious URLs with embedded HTML or script payloads in the request path, attackers can bypass output encoding controls and execute code in the context of a user's session. This vulnerability matters because it requires no authentication, affects multiple release lines, and enables attackers to steal session tokens, credentials, or perform actions on behalf of victims. Organizations running affected Lucee versions—particularly those hosting CFML applications on public-facing servers—face immediate risk of session hijacking and account compromise.

Casky's 322 matched skills detect the attack patterns behind this vulnerability by analyzing techniques across TA0001 (Reconnaissance) and TA0043 (Reconnaissance) for initial payload crafting and delivery. Claude's extended reasoning identifies malicious URL path injection by correlating encoding gaps with reflection points in server responses, flagging when user-controlled input appears unencoded in HTML context. Practitioners using Casky would see findings highlighting: (1) URLs containing script tags or event handlers in path parameters that execute in responses, (2) missing or ineffective output encoding on reflected content, and (3) authentication bypass indicators showing unauthenticated users can trigger XSS. The platform maps findings to CWE-79 violations and MITRE techniques, enabling security teams to prioritize patching affected Lucee instances and implement input validation or Web Application Firewall rules to block path-based XSS attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-29519.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-29519

Casky has 322 skills that investigate the attack patterns behind CVE-2026-29519. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn