SB2026100642 - Path traversal in Atlassian Fisheye

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026100642

SB2026100642 - Path traversal in Atlassian Fisheye

Published: October 6, 2026

Security Bulletin ID SB2026100642
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Path traversal (CVE-ID: CVE-2026-21589)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read files within the web application root directory.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in Jira Data Center when handling requests containing path traversal sequences. A remote attacker can send a specially crafted request to read files within the web application root directory.

Exploitation requires prior knowledge of the target file's exact name and path, and directory contents cannot be enumerated.


Remediation

Install update from vendor's website.

References