CVE-2024–55354 in Lucee: Patching the April 2025 Vulnerability and Preventing Recurrence

CVE-2024–55354 is a protection-mechanism-failure vulnerability in Lucee disclosed in Lucee’s April 2025 security advisory: it lets an attacker run code that should have been blocked and access resources that should have been protected by bypassing Lucee’s sandboxing. The mechanism is specific — an attacker who can write files to the server can copy pre-compiled bytecode files and save them as .cfm or .cfc files, which Lucee then executes, sidestepping the security restrictions applied to normal source code. It primarily threatens multi-tenant/shared-hosting environments that rely on web-context sandboxing to isolate tenants. The fix is twofold: upgrade to a patched Lucee version — 5.4.7.3 LTS (released April 8, 2025), 6.1.1.118+, 6.2.0.321+, 6.2.1 RCs, or 7.0.0.178 (where the protection is on by default) — and/or enable the bytecode-blocking setting via the Java system property -Dlucee.compiler.block_bytecode=true (or environment variable LUCEE_COMPILER_BLOCK_BYTECODE=true), then restart Lucee. This setting blocks pre-compiled bytecode from running as .cfm/.cfc while preserving normal source compilation. This guide covers exactly what the vulnerability is, how to patch it, and how to prevent this class of issue from recurring.
Read More