---

Overview

CVE-2026-21589 is a critical unauthenticated arbitrary file access vulnerability affecting multiple Atlassian Data Center products.

The vulnerability allows a remote, unauthenticated attacker to access specific files located within the application's web application root.

Exploitation does not require valid credentials or user interaction, but the attacker must know the exact name and path of the target file. The vulnerability does not provide directory listing or arbitrary file enumeration.

CVE: CVE-2026-21589 Severity: Critical CVSS v4.0: 9.3 Attack Vector: Network Privileges Required: None User Interaction: None Vulnerability Class: Path Traversal / Arbitrary File Access

Important: This vulnerability should be considered particularly serious for internet-facing self-hosted Atlassian deployments.

---

Affected Products

CVE-2026-21589 affects the following Atlassian products:

Product	Fixed Versions
Bitbucket Data Center	9.4.26, 10.2.8, 10.5.1
Confluence Data Center	9.2.26, 10.2.19
Jira Software Data Center	9.12.40, 10.3.26, 11.3.12
Jira Service Management Data Center	5.12.40, 10.3.26, 11.3.12
Bamboo Data Center	10.2.24, 12.1.12
Crowd Data Center	6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible	4.9.15
Fisheye	4.9.15

All versions prior to the applicable fixed releases are considered affected by Atlassian's advisory.

---

Technical Summary

The vulnerability is associated with improper handling of path information in Atlassian's web-resource processing.

A specially crafted request can cause traversal components to be interpreted as path separators, allowing the request to reach files that should not normally be exposed through the affected resource-handling mechanism.

Conceptually:

Unauthenticated HTTP Request
          |
          v
   Crafted Resource Path
          |
          v
   Path Traversal Handling
          |
          v
Application Web Root
          |
          v
   Target File Disclosure

The attack does not inherently provide directory listing.

An attacker therefore needs prior knowledge of a target file's:

Filename
+
Path

before attempting to retrieve it.

---

Root Cause

The underlying issue involves path normalization and traversal handling in shared Atlassian web-resource functionality.

Security research published after the advisory demonstrated that specially constructed traversal sequences can interact with the application's resource-loading logic.

One important characteristic identified during research is the handling of :: sequences as path separators during request processing.

Conceptually:

Normal Path
    |
    v
Resource Resolver
    |
    v
Expected Application Resource


Malicious Path
    |
    v
Traversal Sequence
    |
    v
Resource Resolver
    |
    v
Unexpected File

The exact exploitation behavior depends on the affected product and deployment configuration.

---

Demo

---

Attack Characteristics

Property	Value
Authentication	Not required
User Interaction	Not required
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
Primary Impact	Confidentiality
Secondary Impact	Potential system compromise depending on exposed files/configuration
Directory Enumeration	Not provided directly
Remote Exploitation	Yes
Internet Exposure Risk	High

The official CVSS v4.0 vector is:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

CVSS Score:

9.3 — CRITICAL

---

Potential Impact

The primary security impact is unauthorized access to files inside the application's web root.

Depending on the product, installation, and exposed file, this may result in disclosure of:

Application configuration
Deployment information
Internal application resources
Credentials or secrets
Integration configuration
Other sensitive application data

The actual impact depends heavily on what files exist within the affected application's web root.

A particularly dangerous scenario can occur when Atlassian products are integrated with Crowd or other centralized authentication infrastructure and sensitive configuration files contain reusable credentials.

Security researchers demonstrated scenarios where exposed Crowd configuration information could potentially be chained into further compromise in certain deployments.

---

Exploitation Requirements

An attacker requires:

1. Network access to the vulnerable Atlassian instance
2. No authentication
3. Knowledge of a target file path
4. A vulnerable product/version

The vulnerability does not provide:

Directory listing
Automatic filesystem enumeration
Authentication bypass by itself
Direct arbitrary command execution

The impact therefore depends strongly on the files that can be identified and retrieved.

---

Detection

Organizations should investigate HTTP access logs for traversal attempts.