Atlassian has released security updates for a critical vulnerability affecting several self-hosted products, including Jira, Confluence and Bitbucket. The Atlassian file-access flaw, tracked as CVE-2026-21589, allows unauthenticated attackers to access specific files within an application’s web root directory.
However, exploitation requires advance knowledge of the target file’s exact name and path. The vulnerability does not let attackers browse directories or list their contents.
Atlassian says it currently has no evidence of active exploitation. Nevertheless, it urges administrators to update affected installations immediately.
Vulnerability Allows File Access Without Signing In
The flaw affects files within the web application root directory of vulnerable installations. An attacker does not need an authenticated account to exploit it.
However, the requirement to know an exact file location limits what an attacker can retrieve. The advisory does not describe unrestricted access to every file on the underlying server.
That distinction matters when assessing the potential impact. The issue enables access to specific application files rather than general directory browsing.
Security Updates Cover Eight Product Lines
Atlassian identifies the following releases as fixes for the vulnerability across affected product branches:
| Product | Fixed versions |
|---|---|
| Bitbucket Data Center | 9.4.26, 10.2.8, 10.5.1 |
| Confluence Data Center | 9.2.26, 10.2.19 |
| Jira Service Management Data Center | 5.12.40, 10.3.26, 11.3.12 |
| Jira Software Data Center | 9.12.40, 10.3.26, 11.3.12 |
| Bamboo Data Center | 10.2.24, 12.1.12 |
| Crowd Data Center | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
| Crucible | 4.9.15 |
| Fisheye | 4.9.15 |
Administrators should check their installed product and release branch against the relevant fixed version.
Meanwhile, cloud customers do not need to take action. Atlassian says it has already applied the necessary fixes to its cloud products.
Temporary Measures Can Restrict Exposure
If immediate patching is not possible, Atlassian recommends restricting external network access to affected installations. This also applies to internet-facing services that normally require users to sign in.
The advisory additionally describes temporary filtering measures designed to block specified traversal patterns.
These include web application firewall or proxy rules across affected products. Product-specific options include Tomcat RewriteValve rules for Confluence, Jira Service Management, Jira, Bamboo and Crowd, plus a URL rewrite rule for Bitbucket.
However, administrators must apply the relevant changes across every cluster node. Bitbucket deployments also require coverage for mirrors and mirror farm nodes.
These measures provide temporary protection while administrators arrange updates for the Atlassian file-access flaw.
Administrators Urged to Review Access Logs
Although Atlassian has not identified active exploitation, it recommends checking access logs for the traversal patterns described in its bulletin.
The company cannot determine whether individual customer-managed installations have suffered a compromise. Consequently, organizations running self-hosted products should involve their security teams when reviewing possible exposure.
Applying a fixed release addresses the vulnerability. Separately, reviewing historical access logs may help teams identify suspicious requests made before the update.
0 responses to “Critical Atlassian File-Access Flaw Prompts Jira and Confluence Updates”