Atlassian has discovered a critical vulnerability in eight of its Data Center products, which customers deploy on their own servers. The flaw allows attackers to read specific files in the root directory of web applications without any authorization.
Atlassian has discovered a critical vulnerability in eight of its Data Center products, which customers deploy on their own servers. The flaw allows attackers to read specific files in the root directory of web applications without any authorization.
The threat is described in the company's official blog. The vulnerability has received the identifier CVE-2026-21589 and a high level of danger - 9.3 points out of 10 possible on the CVSS scale.
A path traversal error requires the hacker to know the exact name and path to the file, as it is impossible to view the entire contents of the directory. However, the developers note that in certain configurations, the root folder of a web application may contain sensitive data, which significantly increases the risk of compromise. Among the vulnerable products were popular tools for development and project management: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye.
The cloud versions of these services have already received the appropriate patches, so Atlassian Cloud customers do not need to take any additional action. However, the company strongly recommends that administrators of self-hosted instances update to the fixed versions as soon as possible. If an immediate update is not possible, experts advise isolating servers from the public internet or applying temporary blocking rules at the firewall (WAF) level or Tomcat configurations.
It is not known for certain whether hackers managed to exploit this flaw in practice.
“Atlassian cannot confirm whether your instances have been compromised due to this vulnerability,” the company warns.
Security teams are advised to independently check access logs for specific URL requests containing directory transition characters.
