criticalCVE-2026-21589CVSS 9.8

Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read

Could this critical Jira vulnerability affect your website?

Atlassian products including Jira, Confluence, and Bitbucket Data Center contain a pre-authentication arbitrary file read vulnerability in the shared atlassian-plugins-webresource library. The library improperly handles double colons (::) as path separators in the resource routing, allowing unauthenticated attackers to traverse the filesystem and read arbitrary files within the application server's webroot, including sensitive configuration files such as web.xml and crowd.properties containing plaintext credentials.

Enter a domain you own and we will test it right now — and, while we are there, report anything else it exposes publicly. No account, no agent to install.

No signup. Takes about a minute. We request pages your server already serves publicly — nothing is written, exploited or brute-forced.

Recommended remediation

Update to the fixed versions: Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19, Bitbucket 9.4.26/10.2.8/10.5.1, Bamboo 10.2.24/12.1.12, Crowd 6.3.7/7.0.3/7.1.7/7.2.4, Crucible 4.9.15, Fisheye 4.9.15.

Tags

cvecve2026atlassianjiraconfluencebitbucketlfipath-traversalvkev