CVE-2021-26085
Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
Description
CVE-2021-26085 is a pre-authentication arbitrary file read vulnerability in Atlassian Confluence Server and Data Center that allows an unauthenticated remote attacker to read arbitrary files on the server. The flaw exists in the way Confluence handles certain HTTP requests, enabling path traversal to access sensitive configuration files, credentials, and other data stored on the server filesystem. CISA added CVE-2021-26085 to the Known Exploited Vulnerabilities catalog on March 28, 2022, confirming active exploitation in the wild. With an EPSS score of 97.2% (99.9th percentile), this vulnerability has an extremely high exploitation probability, making it one of the most actively targeted Confluence vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| atlassian | confluence data center | < 7.4.10; >= 7.5.0, < 7.12.3 |
| atlassian | confluence server | < 7.4.10; >= 7.5.0, < 7.12.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html(Exploit, Third Party Advisory, VDB Entry)
- https://jira.atlassian.com/browse/CONFSERVER-67893(Issue Tracking, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26085(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 describes a weakness where software uses external input to construct a pathname for a file or directory without properly neutralizing special elements that could resolve outside the intended directory. In CVE-2021-26085, Confluence Server fails to properly restrict file path operations in certain HTTP request handlers, allowing an unauthenticated attacker to read files outside the intended web application directory.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2021-26085 allows unauthenticated remote attackers to read arbitrary files from Confluence Server instances, posing a severe threat to data confidentiality. Attackers can access sensitive configuration files including database connection strings, LDAP credentials, and application secrets that may enable further attacks against the organization's infrastructure. The pre-authentication nature of this vulnerability means no valid Confluence credentials are needed, dramatically lowering the barrier to exploitation. Combined with its 99.9th percentile EPSS score, CVE-2021-26085 represents a critical information disclosure risk for any internet-exposed Confluence Server instance.
Exploit Maturity
CVE-2021-26085 is actively exploited in the wild, as confirmed by CISA's inclusion in the KEV catalog on March 28, 2022. The EPSS score of 97.2% (99.9th percentile) places this among the most likely-to-be-exploited vulnerabilities in the entire CVE ecosystem, reflecting widespread automated scanning and exploitation activity. Public proof-of-concept exploits are available, and the pre-authentication nature of the vulnerability makes it trivially exploitable by automated tools without any credential requirements.
Remediation
- Upgrade Atlassian Confluence Server and Data Center to a patched version as specified in the Atlassian security advisory — versions released after July 2021 address this vulnerability.
- If immediate patching is not possible, restrict network access to Confluence Server instances by placing them behind a VPN or reverse proxy that enforces authentication before reaching the Confluence application.
- Audit server logs for suspicious file read attempts and path traversal patterns in HTTP request URLs targeting the Confluence instance.
- Review any sensitive configuration files and credentials that may have been exposed, and rotate all secrets stored on the Confluence server filesystem including database passwords and LDAP bind credentials.
- Consider implementing a web application firewall (WAF) with path traversal detection rules as an additional layer of defense for internet-facing Confluence deployments.
Technical Details
CVE-2021-26085 is a pre-authentication arbitrary file read vulnerability in Atlassian Confluence Server and Data Center caused by improper input validation in HTTP request handling. The vulnerable endpoint processes user-supplied path components without adequately sanitizing directory traversal sequences (such as ../ patterns), allowing an unauthenticated attacker to escape the web application root and read arbitrary files from the server filesystem. The attack is conducted entirely over HTTP/HTTPS with no authentication required, making it remotely exploitable with minimal complexity. Sensitive files commonly targeted include Confluence's configuration files containing database credentials, LDAP bind passwords, and other secrets critical to the application's security posture.
Frequently Asked Questions
Is CVE-2021-26085 being actively exploited?
Yes, CVE-2021-26085 is confirmed as actively exploited in the wild. CISA added it to the KEV catalog on March 28, 2022, and its EPSS score of 97.2% (99.9th percentile) indicates extremely high real-world exploitation activity. Public exploit code is readily available.
What products are affected by CVE-2021-26085?
CVE-2021-26085 affects Atlassian Confluence Server and Data Center versions prior to the security fix released in July 2021. All unpatched Confluence Server instances, particularly those exposed to the internet, are vulnerable to unauthenticated arbitrary file reads.
How do I fix CVE-2021-26085?
Upgrade Confluence Server and Data Center to the latest patched version per the Atlassian security advisory. If immediate patching is not feasible, restrict network access to the Confluence instance and place it behind authentication-enforcing infrastructure such as a VPN or reverse proxy.
How severe is CVE-2021-26085?
CVE-2021-26085 is a high-severity pre-authentication information disclosure vulnerability with an EPSS score in the 99.9th percentile. While it does not directly enable code execution, the ability to read arbitrary files — including credentials and configuration secrets — can serve as a stepping stone for full system compromise through credential reuse or lateral movement.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.