CVE-2021-26086 Atlassian Jira Server and Data Center Path Traversal

What is CVE-2021-26086?

CVE-2021-26086 is a medium-severity path traversal vulnerability in Atlassian Jira Data Center, published on 16 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

Weakness: CWE-22

Which versions are affected by CVE-2021-26086?

It affects 2 products.

Products include Atlassian Jira Data Center, Atlassian Jira Server.

How do I fix CVE-2021-26086?

No fix has been published for CVE-2021-26086 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 Dec 2024.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-26086 being exploited?

Yes. Attackers have exploited CVE-2021-26086 in the wild since at least 12 Nov 2024.

Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 3 proofs of concept on GitHub.

Other vulnerabilities in Atlassian Jira Data Center

• CVE-2022-0540 Auth bypass in Jira Core Server Critical 9.8
• CVE-2020-36239 Deserialization in Jira Core Data Center Critical 9.8
• CVE-2025-22167 Path traversal in Jira Software Data Center High 8.7
• CVE-2019-20419 Other in Jira Server High 7.8
• CVE-2024-21685 Information disclosure in Jira Core Data Center High 7.4

All Atlassian Jira Data Center vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vvhj-8w7x-qj58.