Atlassian DC File Read (CVE-2026-21589): :: Traversal on /download/resources/

When :: in a URL becomes ../

CVE-2026-21589 affects Atlassian Data Center and self-managed stacks—Jira, Confluence, Bitbucket, Bamboo, Crowd, and related products—not Atlassian Cloud SaaS. It is unauthenticated arbitrary file read inside the Tomcat web application root (CVSS 4.0 9.3 Critical), not remote code execution by itself.

The bug lives in shared atlassian-plugins-webresource: static assets under /download/resources/ pass through Router.unescapeSlashes(), which turns :: into /. Traversal segments written as ..:: become ../, bypassing slash normalization and reaching ResourceFactory file reads.

Public PoC and lab tooling: CVE-2026-21589 on pocbit.org. Repository: murrez/CVE-2026-21589.

What defenders should assume

| Reality | Implication | |---------|-------------| | No directory listing | Attackers need known paths (WEB-INF/web.xml, WEB-INF/classes/crowd.properties, Bitbucket urlrewrite.xml, etc.) | | Read stays in web root | Not full-disk arbitrary read—but enough for secrets in standard layouts | | Crowd integration | Parsed crowd.properties may expose application credentials; follow-on impact depends on network path to Crowd and allowlists | | Not a web shell | Patch priority is still critical because config and SSO material enable lateral steps |

Patching matrix (examples—confirm against vendor)

| Product | Example fixed lines | |---------|---------------------| | Jira Software / JSM DC | 9.12.40+, 10.3.26+, 11.3.12+ | | Confluence DC | 9.2.26+, 10.2.19+ | | Bitbucket DC | 9.4.26+, 10.2.8+, 10.5.1+ |

Apply the advisory that matches your major/minor train; FOFA titles do not prove patch level.

Defender checklist

| # | Action | Detail | |---|--------|--------| | 1 | Inventory self-hosted Atlassian versions | Not *.atlassian.net cloud tenants | | 2 | Emergency patch per product bulletin | JRASERVER / CONFSERVER / BSERV issue keys in vendor comms | | 3 | Decode access logs | Hunt ..::, %3a%3a, WEB-INF under /download/resources/ | | 4 | If crowd.properties may have leaked | Rotate Crowd application password; Crowd audit review | | 5 | Network | Do not expose DC UIs to the open internet without strong need |

Cross-read: how to prioritize critical CVEs, incident response — first 24 hours, reading vendor security advisories.

Detection hints (your assets only)

Self-managed fingerprints: login titles, /download/resources/, jira.webresources, X-AUSERNAME, Confluence request headers. Exclude cloud hostnames in search indexes; always run authorized check mode from the PoC page.

Patch validation in a lab

1. Isolated DC trial or vendor-supported test instance on a vulnerable build.
2. --mode check then controlled exploit --file WEB-INF/web.xml.
3. Upgrade to patched build; confirm probe fails or returns Invalid field path-class behavior per product.

See safe PoC lab setup and CVE PoC testing step-by-step.

FAQ

We only use Cloud—skip?

Cloud is out of scope for this on-prem chain; this article targets Data Center / server estates.

Is this “just LFI”?

It is authenticated-less read of application secrets—treat like credential exposure, not informational low severity.

Bottom line

CVE-2026-21589 is a parser normalization bug with enterprise blast radius. Patch Atlassian DC on a documented schedule, hunt :: traversal in logs, and rotate Crowd integration secrets if there was any exposure window.