This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Atlassian fixes 15 vulnerabilities in various products

Atlassian fixes 15 vulnerabilities in various products. The most severe vulnerabilities are described below; the remaining ones can be found at [1] by clicking through the individual advisories. The fixed versions can be found in the links next to the individual vulnerabilities.

Jira Software Data Center, Jira Service Management Data Center - path traversal (CVE-2026-23950)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker, due to a path traversal vulnerability in Jira Software Data Center and Jira Service Management Data Center when processing a forged tar archive, to overwrite files in the file system following user interaction [2][3].

The vulnerability is present in product:

  • Jira Software Data Center; >=11.3.0, <11.3.3; >=10.3.0, <10.3.18

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

More information:

The vulnerability was publicly disclosed 17. 3. 2026.

Bamboo Data Center - RCE (CVE-2026-21570)
CVSS 8.6 (High)

Allows an authenticated remote attacker in Bamboo Data Center to execute arbitrary code on the remote system [4].

The vulnerability is present in product:

  • Bamboo Data Center; >=9.6, <9.6.24; >=10.2, <10.2.16; >=12.1, <12.1.3

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 18. 2. 2026.

Crowd Data Center - XSS (CVE-2026-21884)
CVSS 8.2 (High)

Allows an unauthenticated remote attacker, due to a DOM-based XSS vulnerability in Crowd Data Center, to execute arbitrary HTML or JavaScript code in the victim's browser following user interaction [5].

The vulnerability is present in product:

  • Crowd Data Center; >=7.1, <7.1.5

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

More information:

  • CVE-2026-21884 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 3. 3. 2026.

Jira Data Center, Jira Service Management Data Center – file inclusion (CVE-2026-23745)
CVSS 8.2 (High)

Allows a local attacker in Jira Software Data Center and Jira Service Management Data Center, following user interaction, to display the contents of a local file or execute another file already stored on the server [6][7].

The vulnerability is present in products:

  • Jira Software Data Center; >=10.3, <10.3.18; >=11.3, <11.3.3
  • Jira Service Management Data Center; >=10.3, <10.3.18; >=11.3, <11.3.3

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

More information:

  • CVE-2026-23745 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 6. 3. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 24. 3. 2026.

CESNET, z.s.p.o. Logo