ZeroDay Findings
Sign inSign up

Findings

CVE-2021-26086

Atlassian Jira Server and Data Center Path Traversal Vulnerability

Published Aug 15, 2021 · updated Jun 16, 2026 · atlassian jira data center

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 15, 2021 · Catalog

    Detected

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

  2. Nov 12, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Dec 3, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Dec 3, 2024

Affected

  • cpe atlassian/jira data centerversion unspecified
  • cpe atlassian/jira serverversion unspecified
  • vendor Atlassian Jira Server and Data Centerversion unspecified

Sources

  • CISA KEVCVE-2021-26086

    Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.

    cisa.gov
  • CVE.orgCVE-2021-26086

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-26086

    30-day exploitation probability 100.0%

    first.org
  • Exploit Database50380

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2021-26086

    Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References