Description
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Atlassian | Jira Server | unspecified – < 8.5.14, 8.6.0 – < unspecified, unspecified – < 8.13.6, 8.14.0 – < unspecified, unspecified – < 8.16.1 | 8.5.14 |
| Atlassian | Jira Data Center | unspecified – < 8.5.14, 8.6.0 – < unspecified, unspecified – < 8.13.6, 8.14.0 – < unspecified, unspecified – < 8.16.1 | 8.5.14 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read EDB-50380 · webapps · Oct 6, 2021
GitHub 3 repositories
-
ColdFusionX/CVE-2021-26086 ★ 25 · Oct 5, 2021
Atlassian Jira Server/Data Center 8.4.0 - Arbitrary File read (CVE-2021-26086)
-
Official-BlackHat13/CVE-2021-26086 ★ 0 · Nov 16, 2021
Confluence server webwork OGNL injection
-
Jeromeyoung/CVE-2021-26086 ★ 0 · Sep 5, 2021
Confluence OGNL Injection [CVE-2021-26084].
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Atlassian Jira Limited - Local File Inclusion http/cves/2021/CVE-2021-26086.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.