ColdFusion Markup Language, more commonly known asCFML, is ascripting language for web development that runs on theJava virtual machine (JVM), the.NET framework, andGoogle App Engine. Several commercial andfree and open-source software implementations of CFML engines are available, includingAdobe ColdFusion,Lucee, New Atlanta BlueDragon (Java and .NET versions),Railo, Open BlueDragon, andother CFML server engines.

In its simplest form, like many other web scripting languages, CFML augments standardHTML files withdatabase commands, conditionaloperators, high-level formattingfunctions, and other elements to produceweb applications.^[1][2] CFML also includes many other constructs including ColdFusion Components (CFCs), CFML's version ofobjects, that allow separating business logic from presentation.

CFML can be written using either tags orCFScript, which resemblesJavaScript (ECMAScript).

The pages in a CFMLapplication include theserver-side CFML tags and functions in addition to HTML tags. Modern CFML applications also tend to have CFCs that are accessed by the CFML pages for executing business logic. When aweb browser requests a page in a ColdFusion application, it is automatically pre-processed by the ColdFusionapplication server.^[3]

CFML can also be used to generate other languages, aside from HTML, such asXML,JavaScript,CSS, and so on.

Despite the name, CFML isnot a markup language. It is also notSGML, since certain core CFML features prevent it from complying.

The CFML engine is configured in such a way that certain file extensions on the server (.cfm, .cfc) are handed off to the CFML engine for processing. In the case of the Java-based engines this is accomplished viaJava servlets. The CFML engine only processes CFML tags and functions; it returns text outside of CFML tags and functions to theweb server unchanged.^[4]

Named Cold Fusion at the outset, the software was created in 1995 by theAllaire Corporation, originally located inMinnesota. It later moved to Cambridge, Massachusetts and then finally to Newton, Massachusetts before being acquired byMacromedia in 2001. Allaire Cold Fusion thus became Macromedia Cold Fusion. At the release of version 4, the space in the name was removed to become ColdFusion. Adobe acquired Macromedia in 2005. As of 2023^[update], it is still actively developing ColdFusion.

In 1998 Alan Williamson and his Scottish company, "n-ary", began creating a templating engine for Java to simplify common programming tasks.^[5] Williamson was using curly-brace notation instead of tags, but when he saw an example of CFML and how it was solving similar problems (although not in Java) using a tag syntax, he started developing what would eventually become BlueDragon, which was the first Java implementation of the CFML language. (ColdFusion was written inC andC++ until version 6.0, the first Java-based version, was released in 2002.) New Atlanta licensed BlueDragon around 2001 and made it available as a commercial product, eventually creating a.NET implementation of CFML. Open BlueDragon is a fork of the commercial BlueDragon product and was first released in 2008.

The Railo CFML engine began as a student project in 2002 and was first launched as a commercial project in 2005.^[6] Railo announced they were making the engine open source in 2008, and the first open source version was released in 2009.

On June 18, 2009,Adobe announced at the CFUnited conference that it had formed a CFML Advisory Committee^[7] that would be responsible for guiding and reviewing changes to the CFML language. This effort was disbanded in 2010. TheGoogle Group CFML Conventional Wisdom was created as a forum for open, public discussions about language and engine features; its use has dwindled since 2011.^{[citation needed]}

In 2012, the OpenCFML Foundation was launched. Its function is to pushopen-source CFML applications and platforms.

Former Railo lead developer Michael Offner launchedLucee, a fork ofRailo, in London on January 29, 2015. Backed by community supporters and members of the Lucee Association, the goal of the project is to provide the functionality of CFML using fewer resources, giving better performance and to move CFML past its roots and into a modern and dynamic Web programming platform.

In 2025, CFML was still in use. Lucee will hold a CFML conference, CFCAMP, on May 22-23, 2025.^[8] The Adobe ColdFusion Summit 2025 is to be held September 21-24, 2025.^[9]

CFML tags have a similar format to HTML tags. They are enclosed inangle brackets (< and >) and generally have zero or more namedattributes, though some tags (e.g. cfset, cfif) contain an expression rather than attributes. Many CFML tags have bodies; that is, they have beginning and end tags with text to be processed between them. For example:

<cfoutput>#value# Bob!</cfoutput>

Other tags, such as cfset and cfftp, never have bodies; all the required information goes between the beginning (<) character and the ending (>) character in the form of tag attributes (name/value pairs), as in the example below. If it is legal for tags not to have a body, it is syntactically acceptable to leave them unclosed as in the first example, though many CFML developers choose to self-close tags as in the second example to (arguably) make the code more legible.

<cfsetvalue="Hello"><cfsetvalue="Hello"/>

Even if the tag can have a body, including a body may not be necessary in some instances because the attributes specify all the required information. In these cases, as with the second example above, the end tag (and hence, the tag body) may be omitted and the tag may be self-closing as in the following example:^[10]

<cfexecutename="C:\\winNT\\System32\\netstat.exe"arguments="-e"outputfile="C:\\Temp\\out.txt"timeout="1"/>

Various tags offer the ability to type-check input parameters (e.g. cffunction, cfparam, cfqueryparam) if theprogrammer declares their type specifically. This functionality is used with cfqueryparam tosecure web applications and databases fromhackers and malicious web requests such asSQL injection.

Nearly 100 tags and many more functions make up the heart of the CFML language. The following lists CFML tags by their function or purpose.^[11]

• Application framework
• Communications
• Control
  • Flow-control
  • Database manipulation
  • Exception handling
• Data output
• Debugging
• Display management
• Extensibility
• File management
• form
• Internet Protocol
• Page processing
• Security
• Variable manipulation
• Other tags (cfimage, cfregistry etc.)

CFML allows language extensions in the form of custom tags, which are tags created by the developer that are not part of the CFML language itself. Custom tags are regular CFML files which are intended to be invoked as tags, although it is possible to treat atemplate as both a custom tag and a regular template. Custom tags are written in CFML and are typically invoked by prefixing the custom tag's file name withcf_, although there are other ways to invoke custom tags.

If a template is invoked as a custom tag, the attributes used to invoke that tag are available within the tag in anattributes scope and the variables for the calling page are accessible via thecaller scope.

For example, if writing a custom tag to performaddition, taking two attributes and adding them together, the tag would be an addition.cfm file which could look like this:

<cfsetcaller.addition=attributes.first+attributes.second/><cfexitmethod="exitTag"/>

Assuming the tag is in the same directory as the file (or in a pre-defined customtags directory), it can be invoked thus:

<cf_additionfirst="1"second="2">

CFX tags are custom tags which are developed usingJava orC++, and are prefixed with cfx_ just like cf_. Java and C++ tags are added to the CFML runtime environment using the CFML engine's administrator or by editing configuration files.^{[citation needed]}

On some CFML enginesJSP tags can also be included in CFML pages using the <cfimport> tag.^[12]

ColdFusion Markup Language includes a set of functions that you use to perform logical and arithmetic operations and manipulate data.

CFCs provide some (not all) of the typical features and functionality that are provided byobject-oriented (OOP) languages.To create a CFC:

Create a file with a .CFC extension (this distinguishes CFCs from ColdFusion templates, which have a .CFM extension).

Use four tags to create the components, define their functions andarguments, and return a value.

<cfcomponent>

Defines a CFC

<cffunction>

Defines the functions (methods) within a CFC

<cfargument>

Defines the arguments (parameters) that a function accepts

<cfreturn>

Returns a value or result from a function

CFCs are plain CFML. Within a CFC any CFML tag, function, custom tag, other components, etc. may be used.

CFCs can be used in various ways. If a method contained in a CFC simply needs to be invoked, the<cfinvoke> tag will create an instance of the CFC, invoke the desired method, and then destroy the instance of the CFC.<cfinvoke> takes the name of the component (minus the .cfc extension) and the method to execute. To access any returned data, theRETURNVARIABLE attribute provides the name of a variable to contain whatever the function returns.CFCs are created using four tags, saved as .CFC files, and invoked using the<cfinvoke> tag.^[31]

In the example below, component temperature.cfc has a method FtoC which converts temperature from Fahrenheit to Celsius. The test.cfm template invokes the method and converts 212 degrees Fahrenheit and outputs the result.

<!--- temperature.cfc ---><cfcomponent><cffunctionname="FtoC"access="public"returntype="numeric"><cfargumentname="fahrenheit"required="yes"type="numeric"/><cfsetanswer=(fahrenheit-32)*100/180/><cfreturnanswer/></cffunction></cfcomponent><!--- test.cfm ---><cfsetfDegrees=212/><cfinvokecomponent="temperature"method="FtoC"returnvariable="result"><cfinvokeargumentname="fahrenheit"value="#fDegrees#"/></cfinvoke><cfoutput>#fDegrees#&deg;F =#result#&deg;C</cfoutput><br/>

CFCs may also be instantiated as objects. Assuming a CFC file called Person.cfc, an instance of this CFC would be instantiated as follows:

<cfsetperson=CreateObject("component","Person")/>

CFCs also form the basis of the ability to createweb services in CFML. A CFC is created in the usual way, and the attribute access="remote" added to any function within the CFC will make that function available to be called as aSOAP-based web service. The CFML engine auto-generates aWSDL and creates all the necessary stubs for the web service to function.

Adobe releases security patches for ColdFusion as needed, typically in response to identified vulnerabilities. These updates address critical issues such asarbitrary code execution and security feature bypasses. For instance, on December 23, 2024, Adobe released updates for ColdFusion 2023 and 2021 to resolve a critical vulnerability that could lead to arbitrary file system read. To stay informed about the latest security updates, users should regularly check Adobe's official ColdFusion security bulletins. Additionally, subscribing to Adobe's security notification service ensures timely alerts about new patches and vulnerabilities. Implementing these updates promptly is crucial to maintaining the security and integrity of ColdFusion applications.

• CFML documentation maintained by the community
• CFML in 100 minutes — introduction to the basics of the CFML language.
• A community driven training program that teaches the basics of CFML.
• CFML Slack team
• CFQuickDocs — ColdFusion tags and functions reference.
• Lucee
• Open BlueDragon
• BlueDragon
• Railo
• CFML Conventional Wisdom Google Group
• CFML Advisory Committee (this committee is now defunct)

• CFML programming language
• Domain-specific programming languages

• Webarchive template wayback links
• Articles with short description
• Short description matches Wikidata
• Articles containing potentially dated statements from 2023
• All articles containing potentially dated statements
• All articles with unsourced statements
• Articles with unsourced statements from August 2015
• Articles with unsourced statements from October 2025