#CVE-2026-21589

Critical Path Traversal Bug Exposes Sensitive Files Across Eight Atlassian Data Center Products

Atlassian has published a critical security advisory addressing CVE-2026-21589, an arbitrary file access vulnerability affecting eight self-hosted Data Center and Server products. The vulnerability carries an internal CVSS 4.0 rating of 9.3 and affects Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Under specific conditions, an unauthenticated remote attacker can read sensitive files stored within the target web application root directory without requiring any user interaction or valid credentials. Exploitation requires the attacker to possess prior knowledge of the target file's precise name and path, as the flaw does not facilitate directory enumeration or listing. While Atlassian patched its managed cloud offerings with no reported signs of compromise, administrators managing self-hosted installations are strongly advised to upgrade immediately. For environments where instant patching is unfeasible, Atlassian recommends isolating internet-facing instances or applying specific URL filtering mitigations at the reverse proxy or WAF layer. These temporary mitigations focus on blocking requests containing dot-dot path traversal sequences next to slashes or colons, alongside Tomcat `RewriteValve` rules or `urlrewrite.xml` configurations depending on the product. Discrepancies emerged across CVE documentation and internal tickets regarding specific fixed versions for products like Crowd and Bamboo, as well as legacy Server editions. Security teams are urged to inspect historic web access logs by searching for decoded and double-decoded traversal patterns to detect potential reconnaissance or exploitation attempts.