Path traversal in Postcss - CVE-2026-73646

Vulnerability identifier: #VU139098

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-73646

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in lib/previous-map.js. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Postcss
Crowd Data Center
Jira Software Data Center
Jira Service Management Data Center
Bamboo Data Center

Install updates from vendor's website.

Postcss - update to 8.5.18
Crowd Data Center - update to 7.2.3
Jira Software Data Center - addressed in versions 10.3.25, 11.3.11
Jira Service Management Data Center - addressed in versions 10.3.25, 11.3.11
Bamboo Data Center - addressed in versions 10.2.22, 12.1.11

• https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849

• Path traversal in Postcss
• Multiple vulnerabilities in Bamboo Data Center
• Multiple vulnerabilities in Crowd Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center