Critical Path Traversal in Atlassian Data Center Products (CVE-2026-21589)

CVE-2026-21589 is a critical vulnerability affecting a wide range of self-hosted Atlassian Data Center products, including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye. The vulnerability arises from improper input validation within the /download/* webresource router. Specifically, the router performs a double URL-decode and utilizes an unescaping mechanism that converts :: sequences into / characters. This behavior bypasses Tomcat's URI normalization, allowing unauthenticated attackers to perform path traversal and read arbitrary files relative to the web application root.

By targeting the WEB-INF/ directory, attackers can extract sensitive files such as web.xml, urlrewrite.xml, and other configuration artifacts that may contain JDBC URLs, API tokens, and private keys. While directory listing is not possible, the predictability of Atlassian application file structures makes this vulnerability highly actionable. Active scanning and proof-of-concept exploits have been observed in the wild shortly after disclosure by watchTowr Labs.

Attack Chain

1. Attacker sends a specially crafted GET request to the /download/resources/ endpoint.
2. The path includes a double URL-encoded traversal sequence (e.g., ..%3a%3a) designed to survive initial Tomcat normalization.
3. The webresource router performs a secondary URL-decode on the URI.
4. The router's unescapeSlashes function converts the :: sequence into a / path separator.
5. The application constructs a final path, resulting in a traversal sequence like ../../WEB-INF/web.xml.
6. The ServletContext.getResourceAsStream function resolves the path relative to the application root without further security gating.
7. The application returns the contents of the requested sensitive configuration file in the HTTP response body.
8. Attacker harvests credentials or application metadata from the returned file for subsequent lateral movement.

Impact

The vulnerability allows unauthenticated information disclosure of highly sensitive configuration data. Successful exploitation provides attackers with the necessary building blocks - such as database credentials and API keys - to compromise the underlying server infrastructure, escalate privileges, or facilitate lateral movement within the network. Multiple self-hosted product lines are affected, and active exploitation has been confirmed following the release of public exploit tooling.

Recommendation

Prioritized actions for detection and mitigation:

• Upgrade all affected Atlassian Data Center and Server products to the fixed versions specified in the Atlassian September 2026 security advisory immediately.
• Implement a WAF or reverse-proxy rule to block all incoming requests containing %3a%3a or :: character sequences in the URL path.
• Deploy the specific Tomcat RewriteValve or urlrewrite.xml mitigation rules provided by Atlassian for instances where immediate patching is not feasible.
• Audit web server access logs for anomalous GET requests targeting the /download/resources/ endpoint with traversal patterns containing ..%3a%3a or ..::.