CVE-2026-21589
Summary
| CVE | CVE-2026-21589 |
|---|---|
| State | PUBLISHED |
| Assigner | atlassian |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-05 22:16:58 UTC |
| Updated | 2026-10-05 22:16:58 UTC |
| Description | h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. h3. Context This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. h3. Details: * The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15 * Exploitation requires prior knowledge of the target file's exact name and path. * The vulnerability does not include the capability to enumerate or list directory contents. |
Risk And Classification
Primary CVSS: v4.0 9.3 CRITICAL from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: Path Traversal (Arbitrary Read/Write)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/C... |
| 4.0 | CNA | DECLARED | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
NoneAvailability
NoneSub Conf.
HighSub Integrity
HighSub Availability
HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Atlassian | Bamboo Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Bamboo Data Center | unaffected Patch version 10.2.4 and later | Not specified |
| CNA | Atlassian | Bamboo Data Center | unaffected Patch version 12.1.12 and later | Not specified |
| CNA | Atlassian | Bamboo Server | affected All versions | Not specified |
| CNA | Atlassian | Bitbucket Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Bitbucket Data Center | unaffected Patch version 10.2.8 and later | Not specified |
| CNA | Atlassian | Bitbucket Data Center | unaffected Patch version 10.5.1 and later | Not specified |
| CNA | Atlassian | Bitbucket Data Center | unaffected Patch version 9.4.26 and later | Not specified |
| CNA | Atlassian | Bitbucket Server | affected All versions | Not specified |
| CNA | Atlassian | Confluence Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Confluence Data Center | unaffected Patch version 10.2.19 and later | Not specified |
| CNA | Atlassian | Confluence Data Center | unaffected Patch version 9.2.26 and later | Not specified |
| CNA | Atlassian | Confluence Server | affected All versions | Not specified |
| CNA | Atlassian | Crowd Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Crowd Data Center | unaffected Patch version 7.2.4 and later | Not specified |
| CNA | Atlassian | Crowd Data Center | unaffected Patch version 7.1.1 and later | Not specified |
| CNA | Atlassian | Crowd Data Center | unaffected Patch version 7.0.3 and later | Not specified |
| CNA | Atlassian | Crowd Data Center | unaffected Patch version 6.3.7 and later | Not specified |
| CNA | Atlassian | Crowd Server | affected All versions | Not specified |
| CNA | Atlassian | Crucible Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Crucible Data Center | unaffected Patch version 4.9.15 and later | Not specified |
| CNA | Atlassian | Crucible Server | affected All other versions | Not specified |
| CNA | Atlassian | Crucible Server | unaffected Patch version 4.9.15 and later | Not specified |
| CNA | Atlassian | Fisheye Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Fisheye Data Center | unaffected Patch version 4.9.15 and later | Not specified |
| CNA | Atlassian | Fisheye Server | affected All other versions | Not specified |
| CNA | Atlassian | Fisheye Server | unaffected Patch version 4.9.15 and later | Not specified |
| CNA | Atlassian | Jira Service Management Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Jira Service Management Data Center | unaffected Patch version 11.3.12 and later | Not specified |
| CNA | Atlassian | Jira Service Management Data Center | unaffected Patch version 10.3.26 and later | Not specified |
| CNA | Atlassian | Jira Service Management Data Center | unaffected Patch version 5.12.40 and later | Not specified |
| CNA | Atlassian | Jira Service Management Server | affected All other versions | Not specified |
| CNA | Atlassian | Jira Service Management Server | unaffected Patch version 5.12.40 and later | Not specified |
| CNA | Atlassian | Jira Software Data Center | affected All other versions | Not specified |
| CNA | Atlassian | Jira Software Data Center | unaffected Patch version 11.3.12 and later | Not specified |
| CNA | Atlassian | Jira Software Data Center | unaffected Patch version 10.3.26 and later | Not specified |
| CNA | Atlassian | Jira Software Data Center | unaffected Patch version 9.12.40 and later | Not specified |
| CNA | Atlassian | Jira Software Server | affected All other versions | Not specified |
| CNA | Atlassian | Jira Software Server | unaffected Patch version 9.12.40 and later | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| jira.atlassian.com/browse/BAM-26567 | [email protected] | jira.atlassian.com | |
| jira.atlassian.com/browse/CONFSERVER-104488 | [email protected] | jira.atlassian.com | |
| jira.atlassian.com/browse/FE-7583 | [email protected] | jira.atlassian.com | |
| jira.atlassian.com/browse/CWD-6610 | [email protected] | jira.atlassian.com | |
| jira.atlassian.com/browse/JRASERVER-79546 | [email protected] | jira.atlassian.com | |
| jira.atlassian.com/browse/JSDSERVER-16809 | [email protected] | jira.atlassian.com | |
| jira.atlassian.com/browse/CRUC-8741 | [email protected] | jira.atlassian.com | |
| jira.atlassian.com/browse/BSERV-20604 | [email protected] | jira.atlassian.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.