CVE-2026-21589 is a critical-severity vulnerability, listed in the CISA KEV catalog. AttackerView checks Atlassian Data Center sites for it with a live exploit check.
Detects self-hosted Atlassian products that hand any anonymous visitor the contents of files inside the web application root. Every affected product ships the same plugin web-resource download router, and that router unescapes a double colon to a slash and decodes the resource path a second time after the traversal guard has already inspected it and after Tomcat has normalised the request URI. A resource name built out of double-colon hops therefore reaches the servlet context as a directory traversal, and a single unauthenticated GET reads any file below the web application root whose name the attacker already knows. There is no directory listing, but the useful paths are the same on every install: on instances wired to Crowd, WEB-INF/classes/crowd.properties stores the Crowd application password in plaintext, which attackers have chained into Crowd administration and from there into Jira administrator access. The verifier makes the target return one of its own WEB-INF deployment descriptors and confirms an ordinary resource name on the same route returns nothing, so the finding is the traversal firing and not an error page. It reads only the descriptor and writes nothing. CVSS 9.3, CISA KEV, exploited in the wild. Upgrade to Bitbucket 9.4.26, 10.2.8 or 10.5.1, Confluence 9.2.26 or 10.2.19, Jira Software 9.12.40, 10.3.26 or 11.3.12, Jira Service Management 5.12.40, 10.3.26 or 11.3.12, Bamboo 10.2.24 or 12.1.12, Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4, and Crucible or Fisheye 4.9.15.
Is your app exploitable through CVE-2026-21589?
Scan your domain free