It is pretty publicized that an ColdFusion will look up the directory tree from child to parent directories for an application.cfc file.
This allows all cfm files to be “Locked” unless the application.cfc file that is first found allows the processing of the files.
Is there a way to tell ColdFusion to NOT stop at a sub directory and ALWAYS go to the root?
The reason being is that this situation creates a “Back Door” security problem by simply creating a directory somewhere in the file structure and adding an application.cfc file.
The server would never get to the proper application.cfc and thus the security would never be set properly.
no, there is no way to tell ColdFusion to ALWAYS use application.cfc at the root.
Please secure your web server carefully, upload to outside of webroot, and you should be fine.