Atlassian discloses file-read flaw in eight products

Atlassian disclosed CVE-2026-21589 on 5 October and said it affected eight Data Center products that customers host themselves. The flaw allowed an attacker without login access to read particular files in each product's web application root directory if the attacker already knew the exact path.

Atlassian described the issue as a path traversal and rated it 9.3 under CVSS 4.0. It said that, in some configurations, the affected directory could contain sensitive files and that it had published fixed versions for each product.

The company said its cloud products had already been patched and that it had not found evidence of exploitation. It told customers who could not upgrade at once to take instances offline where possible or to restrict access from outside their networks until they had patched or applied a temporary block.

Atlassian listed three temporary blocking methods. It said all eight products could use a WAF or reverse proxy rule, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd could use a Tomcat RewriteValve rule, and Bitbucket could use a urlrewrite.xml change; Crucible and Fisheye had only the first option.

The article said the CVE record and the advisory did not always match on version numbers, including for Crowd and Bamboo, and that the record also named Server editions for several products. It also said Atlassian had previously seen CVE-2021-26086, a similar path traversal in Jira Server and Data Center, added to CISA's known exploited vulnerabilities catalogue on 12 November 2024.