CVE-2017-16859: The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 b...

Security readout for executives and security teams

This flaw lets a remote attacker read application-path files from vulnerable Atlassian Fisheye and Crucible servers. The sources do not provide severity, CVSS, authentication requirements, or evidence of active exploitation. The business risk is exposure of files inside the running application context, which may include sensitive operational information. Exposure is likely limited to organizations still running affected Atlassian Fisheye and Crucible versions. Internet-facing or broadly reachable instances carry higher concern, but the provided sources do not state authentication requirements or default exposure. Treat as a targeted remediation item for legacy Atlassian deployments. Prioritize if Fisheye or Crucible is externally reachable, contains sensitive source review data, or remains on unsupported versions. Mitigation focus: Identify all Fisheye and Crucible instances and versions.; Upgrade affected instances to a fixed vendor-supported version.; Review Atlassian issue guidance for version-specific remediation details..

Prepared

Jun 7, 2026, 06:24 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.