Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

Atlassian has disclosed CVE-2026-21589, a critical path traversal vulnerability rated 9.3 out of 10, affecting eight self-hosted Data Center products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. An unauthenticated attacker who already knows a file's exact name and path can read that file from the web application's root directory, though they cannot browse the directory's contents. Atlassian has released fixed versions for every affected product and notes its cloud offerings are already patched and show no sign of exploitation so far, while urging self-hosted customers who cannot upgrade immediately to take instances offline or apply temporary WAF, Tomcat RewriteValve, or urlrewrite.xml blocking rules. The company also recommends checking access logs for suspicious path-traversal patterns, since a similar flaw in Jira (CVE-2021-26086) was previously exploited in the wild.