Report feedback

An unauthenticated remote attacker who knows the exact name and path of the target file can access specific files in the web application root directory (without the ability to enumerate its contents), which may lead to the disclosure of sensitive information [1]

The vulnerability is present in products:

• Bitbucket Data Center;>=9.4, <9.4.26;>=10.2, <10.2.8;>=10.5, <10.5.1;
• Confluence Data Center;>=9.2, <9.2.26;>=10.0, <10.2.19;
• Jira Service Management Data Center;>=5.12, <5.12.40;>=10.3, <10.3.26;>=11.3, <11.3.12;
• Jira Software Data Center;>=9.12, <9.12.40;>=10.3, <10.3.26;>=11.3, <11.3.12;
• Bamboo Data Center;>=10.2, <10.2.24;>=12.1, <12.1.12;
• Crowd Data Center;>=6.3, <6.3.7;>=7.0, <7.0.3;>=7.1, <7.1.7;>=7.2, <7.2.4;
• Crucible;>=4.9, <4.9.15;
• Fisheye;>=4.9, <4.9.15;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

More information:

• CVE-2026-21589 at cve.org, NVD
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 10. 2026.