Critical Atlassian flaw lets unauthenticated attackers read known files across eight products

A critical path traversal flaw in eight self-hosted Atlassian Data Center products allows an attacker without login access to read specific files in each product’s web application root directory. The attacker must know the file’s exact name and path and cannot list the directory contents. Atlassian disclosed CVE-2026-21589 on October 5 and rated it 9.3 out of 10.