cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Critical Atlassian Flaw Allows Unauthenticated File Reads Across Eight Self-Hosted Products

· Original article ↗

Summary

CVE-2026-21589 lets unauthenticated attackers read specifically named files in the web roots of eight self-hosted Atlassian products. Atlassian released fixes and temporary blocking rules; its cloud products are patched.

Key points

  • The path-traversal flaw affects versions before the listed fixes in eight self-hosted Atlassian Data Center products.
  • Attackers need to know a file’s exact name and path; the flaw does not let them list directory contents.
  • Atlassian rated the vulnerability 9.3/10 and says some configurations may expose sensitive files.
  • Atlassian says affected cloud products are patched, Bitbucket Cloud is not affected, and its investigation found no evidence of exploitation.
  • Customers should upgrade to a fixed version. Until then, Atlassian advises taking instances offline if possible or restricting external access; it also provides temporary blocking rules.
  • Atlassian recommends reviewing access logs for requests containing path-traversal patterns, but its advisory does not explain how to determine whether a request successfully returned a file.
  • The advisory and CVE record contain conflicting or unclear version details for some products, including Crowd and Bamboo.

Article Details

Vulnerability Types
  • Path traversal allowing unauthenticated access to specifically named files in the web application root directory
Severity
Critical; Atlassian-rated CVSS 4.0 score of 9.3
Affected Versions
  • All versions of the eight affected Data Center products before their respective fixed versions; the article does not provide the full list of fixed versions.
  • Crowd 7.1.6 is listed as affected in a ticket table; the ticket's fix-version field lists 7.1.7, while the CVE record lists 7.1.1.
  • For Bamboo, one CVE-record field lists 10.2.4 and its description lists 10.2.24.
  • The CVE record marks every version of Bamboo Server, Bitbucket Server, Confluence Server, and Crowd Server as affected and lists no fixed versions.
  • The CVE record lists Jira Software Server versions from 9.12.40, Jira Service Management Server versions from 5.12.40, and Crucible Server and Fisheye Server versions from 4.9.15 as unaffected.
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available
Workarounds
  • If unable to upgrade, take the instance offline if possible.
  • Restrict instances reachable from the public internet from outside network access until upgraded or a temporary blocking rule is in place.
  • Atlassian describes temporary blocking rules for requests containing .. directly adjacent to /, \ or ::, including URL-encoded forms; available options depend on the product.

CVE

CVE-2021-26086Attackers have exploited this kind of flaw in an Atlassian product before. CVE-2021-26086 is a path traversal vulnerability in Jira Server and Data Center that allows remote attackers to read specific files. The U.S.CVE-2026-21589a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.3 out of 10, and listed a fixed version for each product.

Vendors

AtlassianA critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory.

Products

BambooCrowd 7.1 release notes date to November 27, 2025, more than 10 months before the flaw was disclosed. For Bamboo, one field said 10.2.4, while the record's own description said 10.2.24.Bitbucketolder self-hosted line, which the advisory did not mention. It marked every version of Bamboo Server, Bitbucket Server, Confluence Server, and Crowd Server as affected and listed no fixed versions for them.Confluenceline, which the advisory did not mention. It marked every version of Bamboo Server, Bitbucket Server, Confluence Server, and Crowd Server as affected and listed no fixed versions for them.CrowdFor Crowd's 7.1 branch, the ticket's fix version field said 7.1.7. A table in the same ticket showed 7.1.6, which the ticket also listed as an affected version.Cruciblelisted versions from 9.12.40 as unaffected, for Jira Service Management Server from 5.12.40, and for Crucible Server and Fisheye Server from 4.9.15. It did not say whether Server licenses can run those versions.Fisheyefrom 9.12.40 as unaffected, for Jira Service Management Server from 5.12.40, and for Crucible Server and Fisheye Server from 4.9.15. It did not say whether Server licenses can run those versions.Jira Service ManagementFor Jira Software Server, the record listed versions from 9.12.40 as unaffected, for Jira Service Management Server from 5.12.40, and for Crucible Server and Fisheye Server from 4.9.15. It did not say whether ServerJira SoftwareFor Jira Software Server, the record listed versions from 9.12.40 as unaffected, for Jira Service Management Server from 5.12.40, and for Crucible Server and Fisheye Server from 4.9.15. It did not say whether Server

Related Articles