CVE-2018-13388: The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attacke...

Security readout for executives and security teams

This is a cross-site scripting issue in Atlassian Fisheye and Crucible review attachments before 4.5.3. A remote attacker could place HTML or JavaScript in attached files, potentially affecting users who open or view them. Exposure is likely limited to organizations running Atlassian Fisheye or Crucible before 4.5.3, especially where review attachments are used or accepted from less-trusted contributors. Treat as a targeted product hygiene issue. Prioritize remediation for internet-facing or broadly accessible collaboration instances, but current sources do not support emergency handling based on exploitation. Mitigation focus: Upgrade Fisheye and Crucible to version 4.5.3 or later.; Check Atlassian advisories for any product-specific workaround guidance.; Restrict attachment upload access to trusted users where possible..

Prepared

Jun 7, 2026, 13:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.