CVE-2021-26086: Atlassian Jira Server and Data Center Path Traversal Vulnerability
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
Published Aug 16, 2021 · Updated Jun 17, 2026
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Atlassian vulnerabilities
All Atlassian entriesCVE-2026-21589
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
critical7.5ExploitedOct 5, 2026CVE-2023-22527
Atlassian Confluence Data Center and Server Template Injection Vulnerability
critical9.8ExploitedJan 16, 2024CVE-2023-22518
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
critical9.8ExploitedOct 31, 2023CVE-2023-22515
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
critical9.8ExploitedOct 4, 2023CVE-2022-36804
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
high8.8ExploitedAug 25, 2022CVE-2022-26138
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
critical9.8ExploitedJul 20, 2022