CVE-2017-9511: Atlassian Crucible

High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days.

The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.

Affected products

• Atlassian Crucible: up to and including 4.4.0
• Atlassian Fisheye: up to and including 4.4.0

Published 2017-08-24. Last modified 2026-06-17.