Atlassian · Confluence Server
CVE-2021-26085
Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
What it is
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
CISA: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 18, 2022
More exploited flaws from Atlassian
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 15, 2026 | Files or Directories Accessible to External Parties | Multiple Products | Critical 9.3 | 99.5% |
| Nov 12, 2024 | Path Traversal | Jira Server and Data Center | Medium 5.3 | >99.9% |
| Jan 24, 2024 | Template Injection | Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Nov 7, 2023 | Improper Authorization | Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Oct 5, 2023 | Broken Access Control | Confluence Data Center and Server | Critical 10.0 | 99.2% |
| Sep 30, 2022 | Command Injection | Bitbucket Server and Data Center | High 8.8 | 99.1% |
| Jul 29, 2022 | Questions For Confluence App Hard-coded Credentials | Confluence | Critical 9.8 | 98% |
| Jun 2, 2022 | Confluence Server and Data Center Remote Code Execution | Confluence Server/Data Center | Critical 9.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.