Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

What exactly can an unauthenticated attacker do through this flaw, and which Atlassian products are affected?

CVE-2026-21589 lets an attacker without a login read selected files from an affected product’s web application root directory. The attacker must know the exact filename and path. They cannot list the directory. Atlassian rated the flaw 9.3 out of 10 because some configurations may store sensitive files there.

The affected products are Crowd, Bamboo, Bitbucket, Confluence, Jira Software, Jira Service Management, Crucible, and Fisheye. The issue is a path traversal flaw. A specially constructed URL can make the application reach a file outside its intended boundary.

Only self-hosted Data Center deployments require customer action. Atlassian says its cloud products were patched already, and cloud customers need not act. Customers should upgrade to a fixed version, restrict public access meanwhile, or apply a temporary blocking rule. The supplied article does not provide every fixed-version number.

What is path traversal, and how can a specially crafted file path bypass normal file-access boundaries?

Path traversal is a file-access weakness. An application expects a request to identify a file inside a controlled directory. If it fails to validate the path correctly, an attacker can add navigation sequences that move beyond that directory. The application then reads a file it was not meant to expose.

In this incident, Atlassian identifies patterns involving two dots directly next to a slash, backslash, or double colon. Attackers may place those patterns directly in a URL or encode them. The server processes the crafted path, and the vulnerable product may return a known file from its web application root or a related location.

The attacker still needs the exact target path and filename. They cannot use this flaw to list the directory automatically. Atlassian recommends blocking matching requests at a web application firewall or reverse proxy, but says those mitigations are limited and do not replace upgrading.

How large is the affected group: how many products and deployment types are involved, and which versions are fixed?

The affected group contains eight Atlassian Data Center products: Crowd, Bamboo, Bitbucket, Confluence, Jira Software, Jira Service Management, Crucible, and Fisheye. The advisory applies to versions before each product’s listed fixed version. It may include versions that have reached end of life.

The article does not reproduce the complete fixed-version table. It reports a Crowd 7.1 fix as 7.1.7 in one ticket field, while a table showed 7.1.6. The CVE record instead listed Crowd 7.1.1. For Bamboo, the record gave both 10.2.4 and 10.2.24 in different fields. These contradictions matter when planning upgrades.

The CVE record also mentions older Server editions, sometimes without fixed versions, but the advisory focuses on Data Center products. Atlassian recommends upgrading to a fixed long-term-support version or later. Customers should verify the exact target version directly in the current product ticket.

What could attackers gain by reading a known file in a web application root directory, even if they cannot list the directory?

The flaw turns a file-serving boundary into a potential information-disclosure path. An attacker does not need to download the whole directory. Knowing one exact filename and path may be enough to retrieve that file, which could contain sensitive material in some configurations.

For example, an attacker might request a known file path through a specially crafted URL containing traversal characters. If the product mishandles that path, it may return the file rather than rejecting the request. The article does not identify which particular files are exposed or say that every installation stores secrets there, so the impact varies by configuration.

This uncertainty is still serious. Exposed information can help an attacker understand or target an instance, and Atlassian rated the vulnerability 9.3 out of 10. Customers should inspect access logs for traversal patterns, restrict network access, and upgrade. The advisory does not explain how to tell whether a suspicious request successfully returned a file.

Why does the distinction between Atlassian Cloud and self-hosted Data Center products determine who must patch and who is responsible for protecting the system?

Deployment type determines responsibility. Atlassian runs and maintains its cloud infrastructure, and says affected cloud products have already been patched. Cloud customers therefore do not need to take action for this flaw. Bitbucket Cloud is specifically reported as unaffected.

Data Center customers host the products themselves. Their instances, network exposure, reverse proxies, logs, and upgrade schedules are under their organizations’ control. A self-hosted instance reachable from the internet can be targeted even if it normally requires a login, because this flaw does not require authentication.

That split creates different priorities. Cloud customers should rely on Atlassian’s service updates. Self-hosted customers must upgrade to a fixed version and investigate logs. If an upgrade cannot happen immediately, they should take the instance offline where possible or restrict outside access until patching or a temporary blocking rule is deployed.

What can organizations do if they cannot upgrade immediately, and why are network restrictions and URL-blocking rules only temporary defenses?

Atlassian’s first recommendation is to take an affected instance offline if immediate upgrading is impossible. Any instance reachable from the public internet should be restricted from outside network access until it is upgraded or protected by a temporary rule. This includes instances that normally require users to log in.

Organizations can also block URLs containing two dots directly beside a slash, backslash, or double colon, including encoded forms. A web application firewall or reverse proxy can apply this rule to all eight products. Confluence, Jira Software, Jira Service Management, Bamboo, and Crowd also support Tomcat RewriteValve rules. Bitbucket has a urlrewrite.xml option. Crucible and Fisheye have only the WAF or proxy option.

These controls are temporary. Filters can be incomplete, misconfigured, or bypassed by variations the rule misses. Atlassian calls the mitigations limited and says they are not replacements for patching. Teams should upgrade, restart affected nodes where required, and review logs for earlier attempts.

How does a web application normally use its root directory and access controls to serve files without exposing the server's underlying files?

A web application root directory is the folder containing the application’s web-facing files. When a browser requests a resource, the application or web server maps the request to an approved location under that root. Normal controls validate the path, restrict which files can be served, and prevent access to unrelated parts of the server.

For example, a request for a permitted page might map to a file inside the root directory. A traversal sequence in the path can instead instruct the system to move through directory boundaries. If validation is defective, the server may resolve the altered path and return a file that should remain outside the requested resource area.

CVE-2026-21589 matters because the affected products can be induced to read specific files without authentication. The attacker still needs the exact path and filename. Strong path normalization, allow-listing, and careful permissions are standard protections, but affected customers should still apply Atlassian’s fixed versions.

Key Facts:

📌 Attackers need no login but must know the exact file path.

📌 Eight self-hosted Atlassian Data Center products are affected.

📌 Cloud products were patched, requiring no customer action.

📌 Path traversal uses crafted paths to cross intended file-access boundaries.

📌 Atlassian’s pattern includes dots beside slashes, backslashes, or double colons.

📌 URL encoding can hide traversal patterns from simple filters.

📌 Eight Data Center products are affected.