CVE-2021-26086: Atlassian Jira Server and Data Center Path Traversal Vulnerability

KEV

Analyzed

Published 16-08-2021Last modified 21-10-2025

Vulnerability summary

CVE-2021-26086 is a medium (CVSS 5.3) vulnerability in Atlassian Jira Server and Data Center. It is known to be exploited: CISA lists it, first on 12-11-2024. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Act nowlisted as exploited

Listed as exploited by CISA (12-11-2024)

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

100.00%

0%100%

Critical · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference, exploit-database

Timeline

16-08-2021
PublishedVulnerability first disclosed.
12-11-2024
Added to CISA KEVExploitedAtlassian Jira Server and Data Center Path Traversal Vulnerability
03-12-2024
CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
21-10-2025
Last modifiedVulnerability information updated.

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.15.3v2.05.0

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 100.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 12-11-2024
Federal due date: 03-12-2024

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. jira.atlassian.com/browse/JRASERVER-72695 nvd.nist.gov/vuln/detail/CVE-2021-26086

Public exploits

2 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databasemultipleUnverified
Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read
Maturity: poc

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Atlassian2 products

jira_data_center≥ unspecified, < 8.5.14 | ≥ 8.6.0, < unspecified | ≥ unspecified, < 8.13.6 | ≥ 8.14.0, < unspecified | ≥ unspecified, < 8.16.1 | < 8.5.14 | ≥ 8.6.0, < 8.13.6 | ≥ 8.14.0, < 8.16.1
jira_server≥ unspecified, < 8.5.14 | ≥ 8.6.0, < unspecified | ≥ unspecified, < 8.13.6 | ≥ 8.14.0, < unspecified | ≥ unspecified, < 8.16.1 | < 8.5.14 | ≥ 8.6.0, < 8.13.6 | ≥ 8.14.0, < 8.16.1

1 vendor · 2 products

References

3 links

jira.atlassian.com/browse/JRASERVER-72695X Refsource MISCIssue TrackingVendor Advisory
packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26086Government ResourceUS Government Resource