Lucee vulnerabilities
We track 3 vulnerabilities in Lucee products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 10, 2026.
Latest Lucee vulnerabilities
- 8.2 High severity
Lucee: Improper Neutralization of Input During Web Page Generation
Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by
- 8.8 High severity
Lucee Server: Reliance on Untrusted Inputs in a Security Decision
Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expected to be blocked and access resources that would be expected
- 9.8 Critical severity
Lucee: Improper Restriction of XML External Entity Reference
Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59