EUVD-2026-92807
GHSA-gr66-x5pq-8g2g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable arbitrary file read (AV:N/PR:N); AC:L since no special conditions beyond knowing a path; confidentiality-only impact, so I:N/A:N and scope unchanged.
Primary rating from Vendor (atlassian).
CVSS VectorVendor: atlassian
Lifecycle Timeline
3DescriptionCVE.org
h3. Summary
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe.
h3. Context
This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions.
h3. Details:
- The vulnerability must be addressed for affected versions of:
Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15
- Exploitation requires prior knowledge of the target file's exact name and path.
- The vulnerability does not include the capability to enumerate or list directory contents.
AnalysisAI
An unauthenticated arbitrary file access vulnerability affects a broad set of Atlassian Data Center and Server products - Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye - allowing a remote attacker to retrieve specific files that reside inside the web application root directory. Exploitation requires the attacker to already know the exact file name and full path of the target; the flaw provides no directory enumeration or listing capability, so it cannot be used to discover files opportunistically. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The instance must be network-reachable and the attacker must already know the exact file name and full path of the target file within the web application root - the vulnerability provides no directory enumeration or listing capability, which is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority for any internet-exposed Atlassian Data Center deployment, though the raw 9.3 CVSS 4.0 score overstates the technical reality somewhat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released fixes for each product line: Bitbucket Data Center 9.4.26, 10.2.8, or 10.5.1; Confluence Data Center 9.2.26 or 10.2.19; Crowd Data Center 6.3.7, 7.0.3, 7.1.1, or 7.2.4; Jira Software Data Center 9.12.40, 10.3.26, or 11.3.12; Jira Service Management Data Center 5.12.40, 10.3.26, or 11.3.12; Bamboo Data Center 10.2.24 or 12.1.12; and Crucible/Fisheye 4.9.15, using the advisories at https://jira.atlassian.com/browse/BAM-26567, https://jira.atlassian.com/browse/BSERV-20604, https://jira.atlassian.com/browse/CONFSERVER-104488, https://jira.atlassian.com/browse/CRUC-8741, https://jira.atlassian.com/browse/CWD-6610, https://jira.atlassian.com/browse/FE-7583, https://jira.atlassian.com/browse/JRASERVER-79546, and https://jira.atlassian.com/browse/JSDSERVER-16809. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all internet-facing and internally reachable Atlassian Data Center and Server instances (Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye) and confirm current versions against the Atlassian advisory; since no vendor-released patch is identified at this time, restrict external access to these products through VPN or identity-aware proxies and audit the web application root for any secret-, token-, or credential-bearing configuration files, relocating or removing them immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bamboo Data Center
View allThis High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in ver
Remote code execution in Atlassian Bamboo Data Center versions 9.6.0 through 12.1.0 allows authenticated attackers with
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today