CVE-2021-26085

🗓️ 03 Aug 2021 00:00:12Reported by atlassianType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 1178 Views🌐 WEB

Atlassian Confluence Server Pre-Authorization Arbitrary File Read vulnerabilit

Reporter	Title	Published	Views	Family All 32
zdt	Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Read Vulnerability	5 Oct 202100:00	–	zdt
GithubExploit	Exploit for Forced Browsing in Atlassian Confluence_Data_Center	5 Oct 202108:20	–	githubexploit
attackerkb	CVE-2021-26085	29 Jul 202100:00	–	attackerkb
Atlassian	Pre-Authorization Limited Arbitrary File Read in Confluence Server - CVE-2020-29448	10 Nov 202000:03	–	atlassian
Atlassian	Pre-Authorization Arbitrary File Read in /s/ endpoint - CVE-2021-26085	21 Jul 202100:18	–	atlassian
Atlassian	Limited Remote File Read in Jira Software Server - CVE-2021-26086	12 Aug 202103:49	–	atlassian
Atlassian	Pre-Authorization Limited Arbitrary File Read in Confluence Server - CVE-2020-29448	10 Nov 202000:03	–	atlassian
Atlassian	Pre-Authorization Arbitrary File Read in /s/ endpoint - CVE-2021-26085	21 Jul 202100:18	–	atlassian
Atlassian	Limited Remote File Read in Jira Software Server - CVE-2021-26086	12 Aug 202103:49	–	atlassian
BDU FSTEC	Atlassian Confluence Server File Read	20 Apr 202200:00	–	bdu_fstec

NVD

Vulners

Node

atlassian confluence_data_centerRange<7.4.10

atlassian confluence_data_centerRange7.5.0–7.12.3

atlassian confluence_serverRange<7.4.10

atlassian confluence_serverRange7.5.0–7.12.3

[
  {
    "product": "Confluence Server",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.4.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.12.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Confluence Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "7.4.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.5.0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.12.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
jira	www.jira.atlassian.com/browse/CONFSERVER-67893
packetstormsecurity	www.packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
WEB-INF/web.xml	path	/s/123cfx/_/;/WEB-INF/web.xml	Pre-Authorization Arbitrary File Read allowing access to web.xml via the /s/ endpoint.	CWE-425
WEB-INF/classes/seraph-config.xml	path	/s/123cfx/_/;/WEB-INF/classes/seraph-config.xml	Pre-Authorization Arbitrary File Read allowing access to seraph-config.xml via the /s/ endpoint.	CWE-425
META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties	path	/s/123cfx/_/;/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties	Pre-Authorization Arbitrary File Read allowing access to pom.properties via the /s/ endpoint.	CWE-425
META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.xml	path	/s/123cfx/_/;/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.xml	Pre-Authorization Arbitrary File Read allowing access to pom.xml via the /s/ endpoint.	CWE-425

17 Jun 2026 03:42Current

5.3Medium risk

Vulners AI Score5.3

CVSS 25

CVSS 3.15.3

EPSS0.99937

SSVC