-
Type:
Public Security Vulnerability
-
Resolution: Fixed
-
Priority:
High
-
Affects Version/s: 9.1.0, 9.0.1, 9.0.2, 9.0.3, 9.1.1, 9.2.0, 9.2.1, 9.4.0, 9.3.1, 9.2.2, 9.3.2, 9.2.3, 9.4.1, 9.2.4, 9.2.5, 9.2.6, 9.5.1, 9.5.2, 9.5.3, 9.2.7, 10.1.0, 9.2.8, 10.0.2, 10.0.3, 9.5.4, 9.2.9, 10.1.1, 10.2.0, 9.2.10, 10.1.2, 9.2.11, 9.2.12, 10.2.1, 9.2.13, 10.2.2, 9.2.14, 10.2.3, 9.2.15, 10.2.6, 9.2.17, 10.2.7, 9.2.19, 10.2.10, 10.2.11, 9.2.20, 9.2.21, 10.2.13, 10.2.14, 10.2.15, 10.2.17, 10.2.18
-
Component/s: None
-
7.5
-
High
-
CVE-2026-73646
-
Atlassian (Internal)
-
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-
Path Traversal (Arbitrary Read/Write)
-
Confluence Data Center
This High severity Path Traversal (Arbitrary Read/Write) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center.
This Path Traversal (Arbitrary Read/Write) vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation, which has high impact to confidentiality, no impact to integrity, no impact to availability, and requires no user interaction.
Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
- Confluence Data Center 11.0: Upgrade to a release greater than or equal to 11.0.0
- Confluence Data Center 10.2: Upgrade to a release greater than or equal to 10.2.19
- Confluence Data Center 9.2: Upgrade to a release greater than or equal to 9.2.22
See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html). You can download the
latest version of Confluence Data Center from the download center
(https://www.atlassian.com/software/confluence/download-archives).
The National Vulnerability Database provides the following description for this vulnerability:
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.