Medium Severity
CVE-2026-21589
Published: Oct 25, 2026
CVE-2026-21589 - Atlassian Data Center Unauth Arbitrary File Read (CVSS 9.3). Red/Blue Team suite with 2 tools: Full Exploit (path traversal, WEB-INF read, interactive shell, 8 products, mass scan, SOCKS5/Tor, stealth) and SafeChecker (non-intrusive version audit, WAF detection, IoC guidance, JSON/CSV/JSONL reports). Use Ethically, Stay Legal.
# CVE-2026-21589 - Atlassian Data Center Unauth Arbitrary File Read Toolkit
[](https://www.python.org/downloads/)
[](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)
[](https://github.com/tc4dy)
[](https://www.atlassian.com/)
> **ETHICAL USE ONLY - AUTHORIZED SECURITY TESTING**
> This repository provides tools for **authorized security professionals, blue teams, and penetration testers** only.
> Unauthorized access to computer systems is illegal under **CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.**
---
## [i] Vulnerability Overview
**CVE-2026-21589** is a critical unauthenticated path traversal and arbitrary file read vulnerability in **Atlassian Data Center products** (Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye). It allows an unauthenticated attacker to read arbitrary files inside the web application root (including `WEB-INF/`) via the `/download/*` webresource router. CVSS score: **9.3 (Critical)**. Disclosed by **watchTowr Labs** in September 2026. Patched by Atlassian in the September 2026 Data Center security advisory.
The flaw affects **eight self-hosted Atlassian products** across multiple version branches. The root cause is a **double URL-decode and `::` to `/` unescaping bug** in the webresource router that bypasses Tomcat's URI normalizer.
### How it works
1. **Double URL-decode in router** - The `/download/*` webresource router calls `URLDecoder.decode(request.getRequestURI())` a second time. Tomcat only decodes the URI once, so `..%3a%3a` sequences survive Tomcat's normalizer and are then resolved inside the application.
2. **`::` to `/` unescaping** - After the second de