EIP-2026-102359

PRE-CVE

Atlassian Confluence AppFusions Doxygen 1.3.0 - Directory Traversal

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-102359. PoCs published by Julien Ahrens.

AI-analyzed exploit summary This advisory details a path traversal vulnerability (CWE-22) in AppFusions Doxygen for Atlassian Confluence, allowing authenticated attackers to upload arbitrary files to any writable directory, potentially leading to Remote Code Execution (RCE). The vulnerability stems from improper validation of the 'tempId' parameter in the upload functionality.

Description

Atlassian Confluence AppFusions Doxygen 1.3.0 - Directory Traversal

Exploits (1)

exploitdb WRITEUP
by Julien Ahrens · textwebappsjava
https://www.exploit-db.com/exploits/40794

This advisory details a path traversal vulnerability (CWE-22) in AppFusions Doxygen for Atlassian Confluence, allowing authenticated attackers to upload arbitrary files to any writable directory, potentially leading to Remote Code Execution (RCE). The vulnerability stems from improper validation of the 'tempId' parameter in the upload functionality.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: AppFusions Doxygen for Atlassian Confluence v1.3.0
Auth required
Prerequisites: Authenticated access to Confluence · Permission to upload Doxygen files
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026