This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.
Impact
An unauthenticated attacker can access specific files in the web application root directory of affected Atlassian products, including Bitbucket Data Center, Confluence Data Center, and Jira Software Data Center, if they have prior knowledge of the target file's exact name and path. The vulnerability affects various versions of these products. Exploitation does not allow directory enumeration.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Atlassian · atlassian
Bamboo Data Center
3 ranges
Atlassian · atlassian
Bamboo Data Center
Compare with this publisher’s ranges. This does not inspect your installation.
affected
All other versions
unaffected
Patch version 10.2.24 and later
Patch version 12.1.12 and later
Other versions: unknown
Atlassian · atlassian
Bitbucket Data Center
4 ranges
Atlassian · atlassian
Bitbucket Data Center
Compare with this publisher’s ranges. This does not inspect your installation.
affected
All other versions
unaffected
Patch version 10.2.8 and later
Patch version 10.5.1 and later
Patch version 9.4.26 and later
Other versions: unknown
Atlassian · atlassian
Confluence Data Center
3 ranges
Atlassian · atlassian
Confluence Data Center
Compare with this publisher’s ranges. This does not inspect your installation.
affected
All other versions
unaffected
Patch version 10.2.19 and later
Patch version 9.2.26 and later
Other versions: unknown
Atlassian · atlassian
Crowd Data Center
5 ranges
Atlassian · atlassian
Crowd Data Center
Compare with this publisher’s ranges. This does not inspect your installation.
affected
All other versions
unaffected
Patch version 7.2.4 and later
Patch version 7.1.7 and later
Patch version 7.0.3 and later
Patch version 6.3.7 and later
Other versions: unknown
Atlassian · atlassian
Crucible Data Center
2 ranges
Atlassian · atlassian
Crucible Data Center
Compare with this publisher’s ranges. This does not inspect your installation.
affected
All other versions
unaffected
Patch version 4.9.15 and later
Other versions: unknown
Atlassian · atlassian
Fisheye Data Center
2 ranges
Atlassian · atlassian
Fisheye Data Center
Compare with this publisher’s ranges. This does not inspect your installation.
affected
All other versions
unaffected
Patch version 4.9.15 and later
Other versions: unknown
Atlassian · atlassian
Jira Service Management Data Center
4 ranges
Atlassian · atlassian
Jira Service Management Data Center
Compare with this publisher’s ranges. This does not inspect your installation.
affected
All other versions
unaffected
Patch version 11.3.12 and later
Patch version 10.3.26 and later
Patch version 5.12.40 and later
Other versions: unknown
Atlassian · atlassian
Jira Software Data Center
4 ranges
Atlassian · atlassian
Jira Software Data Center
Compare with this publisher’s ranges. This does not inspect your installation.
affected
All other versions
unaffected
Patch version 11.3.12 and later
Patch version 10.3.26 and later
Patch version 9.12.40 and later
Other versions: unknown
Original source description
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-21589View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.