Atlassian has released fixes for CVE-2026-21589, a critical path traversal vulnerability rated 9.3 on the CVSS scale that enables an unauthenticated attacker to read arbitrary files from eight of its products.
The issue affects Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd in their Data Center editions, as well as Crucible and Fisheye. Disclosure occurred on October 5.
The vulnerability stems from improper handling of directory traversal sequences. The server accepts manipulated paths in which the dot-dot sequences appear directly adjacent to a forward slash, backslash or double colon, including URL-encoded variants. This allows an attacker to traverse outside intended directories.
Important limitations apply. An attacker must already know the exact name and full path of the target file because the flaw does not allow directory listing. The reachable scope is limited to the root folder of each product’s web application. While this rules out fully arbitrary file reads, configuration files stored in predictable locations remain exposed to anyone familiar with the product structure.
Patches are available in the following versions: Bitbucket 10.5.1, Confluence 10.2.19, Jira Software and Jira Service Management 11.3.12, Bamboo 12.1.12, Crowd 7.2.4, and Crucible and Fisheye 4.9.15.
Atlassian stated that its investigation found no evidence of exploitation against its cloud-hosted products. The advisory does not indicate whether attacks have occurred against customer-managed on-premises installations, which are the deployments directly impacted by this issue.
