CVE-2021-26086: Atlassian Jira Server and Data Center Path Traversal Vulnerability

Medium severity, CVSS 5.3. Actively exploited: in CISA KEV since 2024-11-12. EPSS: 100% chance of exploitation in the next 30 days.

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

Affected products

• Atlassian Jira Data Center: before 8.5.14 (fixed in 8.5.14); from 8.6.0, before 8.13.6 (fixed in 8.13.6); from 8.14.0, before 8.16.1 (fixed in 8.16.1)
• Atlassian Jira Server: before 8.5.14 (fixed in 8.5.14); from 8.6.0, before 8.13.6 (fixed in 8.13.6); from 8.14.0, before 8.16.1 (fixed in 8.16.1)

Published 2021-08-16. Last modified 2026-06-17.