CVE-2021-26067 Information disclosure in Bamboo

What is CVE-2021-26067?

CVE-2021-26067 is a medium-severity vulnerability in Atlassian Bamboo, published on 28 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal the path for the home directory in disk and if certain files exists on the tmp directory, via a Sensitive Data Exposure vulnerability in the /chart endpoint. The affected versions are before version 7.2.2.

Weakness: CWE-200

Which versions are affected by CVE-2021-26067?

It affects 1 product.

Products include Atlassian Bamboo.

How do I fix CVE-2021-26067?

No fix has been published for CVE-2021-26067 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-26067 being exploited?

There is no known exploitation of CVE-2021-26067 in the wild and no public exploit code.

Other vulnerabilities in Atlassian Bamboo

• CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Exploited Critical 9.3
• CVE-2022-26136 Auth bypass in Bamboo Data Center Critical 9.8
• CVE-2016-5229 Deserialization in n/a Critical 9.8
• CVE-2014-9757 Deserialization in n/a Critical 9.8
• CVE-2015-8360 Deserialization in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wr59-chw8-frf6.