CVE-2026-21589

Name of the Vulnerable Software and Affected Versions Bitbucket Data Center versions 4.6.0 through 9.4.25, 10.2.7, and 10.5.0 Confluence Data Center versions 5.10.0 through 9.2.25 and 10.2.18 Crowd Data Center versions 2.11.0 through 6.3.6, 7.0.2, 7.1.6, and 7.2.3 Jira Software Data Center versions 7.1.0 through 9.12.39, 10.3.25, and 11.3.11 Jira Service Management Data Center versions 3.1.0 through 5.12.39, 10.3.25, and 11.3.11 Bamboo Data Center versions 7.0.1 through 10.2.23 and 12.1.11 Crucible versions prior to 4.9.15 Fisheye versions prior to 4.9.15

Description An arbitrary file access flaw exists in several Atlassian Data Center products due to improper path handling in the shared atlassian-plugins-webresource library. An unauthenticated remote attacker can read specific files within the web application root directory by using a path traversal payload with a :: delimiter instead of the standard ../ sequence. This bypasses Tomcat's URI normalization because the application performs a second round of URL decoding and subsequently converts :: into forward slashes via the unescapeSlashes() function. Exploitation requires prior knowledge of the target file's exact name and path, as directory enumeration is not possible. In environments integrated with Atlassian Crowd, this can lead to a full administrative takeover if the attacker reads WEB-INF/classes/crowd.properties to obtain plaintext credentials, which can then be used via the Crowd REST API to create rogue administrators. Approximately 700,000 Confluence instances were estimated to be exposed. Real-world exploitation attempts have been observed, including hundreds of requests targeting the /download/resources/ and /s/1.0/ /download/resources/ endpoints.

Recommendations Upgrade Bitbucket Data Center to version 9.4.26, 10.2.8, or 10.5.1. Upgrade Confluence Data Center to version 9.2.26 or 10.2.19. Upgrade Crowd Data Center to version 6.3.7, 7.0.3, 7.1.7, or 7.2.4. Upgrade Jira Software Data Center to version 9.12.40, 10.3.26, or 11.3.12. Upgrade Jira Service Management Data Center to version 5.12.40, 10.3.26, or 11.3.12. Upgrade Bamboo Data Center to version 10.2.24 or 12.1.12. Upgrade Crucible to version 4.9.15. Upgrade Fisheye to version 4.9.15. As a temporary mitigation, restrict external network access to the affected instances. Implement a Web Application Firewall (WAF) rule to block requests containing .. immediately adjacent to /, ``, or ::. For Confluence, enable Tomcat's RewriteValve and configure rewrite.config to block malicious traversal patterns. If Crowd integration is used, rotate the application.password in crowd.properties and audit Crowd logs for unauthorized user creations or group changes.