Affected Systems

8 Atlassian Data Center products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. All versions prior to fixed releases (e.g., Confluence <9.2.26/10.2.19, Jira Software <9.12.40/10.3.26/11.3.12). Cloud products already patched. Atlassian Server editions (end-of-life) also affected with unclear fix availability.

Exploitation Status

No confirmed exploitation reported by Atlassian for cloud or self-hosted instances as of disclosure. However, similar path traversal flaw (CVE-2021-26086) in Jira was exploited in the wild and added to CISA KEV catalog in 2024. Exploitation is straightforward for attackers who know target file paths.

Business Impact

Unauthenticated attackers can read arbitrary files from the web application root directory if exact file path is known. CVSS 9.3 (critical). Cannot list directory contents, but may access sensitive configuration files, credentials, or application code depending on deployment. Internet-facing instances at immediate risk. Atlassian advises taking unpatched instances offline or blocking external access until patched.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade all affected Atlassian Data Center products to fixed versions immediately: Confluence 9.2.26/10.2.19+, Jira Software 9.12.40/10.3.26/11.3.12+, Bitbucket 9.4.26/10.2.8/10.5.1+, Bamboo 10.2.24/12.1.12+, Crowd 6.3.7/7.0.3/7.1.7/7.2.4+, Crucible/Fisheye 4.9.15+, Jira Service Management 5.12.40/10.3.26/11.3.12+
  • If immediate patching is not possible, restrict external network access to all Atlassian instances or take them offline until patched
  • Deploy temporary WAF or reverse proxy rule blocking URLs containing '..' adjacent to '/', '\', or '::' (including URL-encoded variants) as interim mitigation
  • For Confluence, Jira, Bamboo, Crowd: apply Tomcat RewriteValve rule and restart nodes; for Bitbucket: update urlrewrite.xml on all nodes and restart
  • Review access logs for exploitation attempts: URL-decode request lines (up to 2 iterations) and search for '..' patterns adjacent to path separators; escalate any matches to security team for incident response