Critical Atlassian Path Traversal Exposes Sensitive Files Across 8 Products

What it is

CVE-2026-21589 (CVSS 9.3), an unauthenticated path traversal flaw across eight Atlassian Data Center/Server products — Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye.

How it works

Insufficient path validation in the web application layer fails to sanitize input properly. An attacker sends a crafted HTTP request containing path traversal sequences, and the application returns arbitrary files at known paths within the web application root — no authentication required.

Preconditions / Affected

All versions of the eight products prior to the fixed releases below are vulnerable. Risk is highest for internet-facing instances, and especially for Crowd SSO deployments, where plaintext authentication details are stored at predictable file paths and can be read directly.

What to do

Patch to the fixed version for each affected product:

• Bitbucket Data Center: 9.4.26, 10.2.8, or 10.5.1
• Confluence Data Center: 9.2.26 or 10.2.19
• Jira Software Data Center: 9.12.40, 10.3.26, or 11.3.12
• Jira Service Management Data Center: 5.12.40, 10.3.26, or 11.3.12
• Bamboo Data Center: 10.2.24 or 12.1.12
• Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, or 7.2.4
• Crucible: 4.9.15
• Fisheye: 4.9.15

If immediate patching isn't possible: disconnect the instance from the internet, apply WAF rules blocking path traversal patterns, and review access logs for directory traversal sequences.

flowchart TD
    A[Unauthenticated HTTP request\nwith traversal sequence] --> B[Read arbitrary file\nin web app root]
    B --> C{Crowd SSO deployment?}
    C -->|Yes| D[Plaintext credentials exposed]
    D --> E[Create admin account]
    E --> F[Full Atlassian ecosystem takeover]
    C -->|No| G[Sensitive config/file exposure]

Caveats

As of the page's writing, no public proof-of-concept exploit exists and no in-the-wild exploitation has been observed — though the page notes similar past Atlassian vulnerabilities were targeted by ransomware operators and APT groups, making rapid weaponization plausible.