CVE-2026-29519: Lucee CFML Server XSS Vulnerability

CVE-2026-29519 Overview

CVE-2026-29519 is a reflected cross-site scripting (XSS) vulnerability affecting Lucee CFML Server across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines. The flaw resides in the server's URL path parsing logic, which reflects unsanitized input into HTTP responses. Unauthenticated remote attackers can craft malicious URLs that inject arbitrary HTML or JavaScript into a victim's browser. Successful exploitation enables session hijacking, credential theft, and unauthorized actions against the Lucee administrative interface. The weakness is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated administrator's browser session, potentially compromising the Lucee administrative interface without prior credentials.

Affected Products

Lucee CFML Server 5.3.x release line
Lucee CFML Server 6.1.x and 6.2.x release lines
Lucee CFML Server 7.0.x release line

Discovery Timeline

2026-07-10 - CVE-2026-29519 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-29519

Vulnerability Analysis

The vulnerability exists in how Lucee CFML Server parses and reflects portions of the incoming URL path. When a request includes HTML or JavaScript payloads embedded within the path segment, Lucee returns those values inside its response body without applying output encoding. The browser interprets the reflected content as executable markup, triggering script execution in the context of the vulnerable host.

Because the injection point is the URL path itself, exploitation does not require authentication or knowledge of any application session. An attacker only needs to convince a target user, ideally one with administrative access to the Lucee interface, to click a crafted link. The reflected payload executes with the origin of the Lucee server, granting the attacker access to cookies, tokens, and any actions the victim can perform.

Root Cause

The root cause is missing contextual output encoding in the URL path handler. Reflected components of the request are inserted into HTML responses without HTML entity encoding, JavaScript escaping, or a strict content security policy. This aligns with [CWE-79] and is a classic reflected XSS pattern in server-side request processing.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts or distributes a malicious link pointing to a vulnerable Lucee host with a path such as /<script>...</script>. When an authenticated administrator opens the link, the injected script runs in the browser under the Lucee origin. The attacker can then exfiltrate session identifiers, submit administrative form requests, or pivot to further attacks against the CFML application. Public proof-of-concept material is available in the GitHub CVE-2026-29519 PoC and the VulnCheck Lucee XSS Advisory.

No verified exploitation code is reproduced here. See the linked advisory and PoC repository for technical payloads.

Detection Methods for CVE-2026-29519

Indicators of Compromise

HTTP access logs containing URL paths with <script>, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers pointing to untrusted external domains preceding requests to /lucee/admin/ endpoints.
Unexpected administrative actions or configuration changes in Lucee following user clicks on external links.
Outbound requests from administrator browsers to attacker-controlled domains immediately after loading a Lucee URL.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect request paths for HTML tags, event handlers, and script scheme indicators.
Correlate reverse proxy or load balancer logs with browser-side telemetry to identify reflected payloads returning HTTP 200 responses.
Hunt for anomalous administrator sessions originating from unusual user agents or IP addresses shortly after suspicious URL requests.

Monitoring Recommendations

Enable verbose access logging on all Lucee endpoints, including full request URIs and referers.
Alert on any request path containing angle brackets or JavaScript keywords targeting Lucee hosts.
Monitor the Lucee administrative interface for logins and configuration changes originating from browsers that recently rendered externally referred URLs.

How to Mitigate CVE-2026-29519

Immediate Actions Required

Restrict network access to the Lucee administrative interface to trusted management networks or VPN users only.
Instruct administrators to avoid clicking Lucee URLs received from external or untrusted sources until patched.
Deploy WAF signatures that block requests containing HTML or JavaScript payloads within URL paths destined for Lucee hosts.
Rotate Lucee administrator credentials and invalidate active sessions if suspicious link activity is suspected.

Patch Information

At the time of publication, refer to the VulnCheck Lucee XSS Advisory for the latest fixed release information across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x branches. Upgrade to the vendor-designated patched build for your release line as soon as it is available and validated in a staging environment.

Workarounds

Place Lucee behind a reverse proxy that strips or rejects request paths containing HTML metacharacters such as <, >, ", and '.
Enforce a strict Content-Security-Policy response header that disallows inline scripts and restricts script sources to trusted origins.
Require administrators to access the Lucee console from dedicated management workstations without general web browsing.

bash

# Example NGINX reverse proxy filter blocking HTML metacharacters in the URL path
location / {
    if ($request_uri ~* "(<|%3C|>|%3E|script|javascript:)") {
        return 403;
    }
    proxy_pass http://lucee_backend;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
}