CVE-2021-26086
Atlassian Jira Server and Data Center Path Traversal Vulnerability
Description
CVE-2021-26086 is a medium-severity path traversal vulnerability in Atlassian Jira Server and Data Center that allows remote, unauthenticated attackers to read specific files from the server via the /WEB-INF/web.xml endpoint. With a CVSS v3.1 base score of 5.3, the vulnerability enables limited information disclosure by allowing attackers to access configuration files that may reveal internal application structure and sensitive settings. Affected versions include Jira Server and Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1. CISA has added CVE-2021-26086 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 3, 2024, and its EPSS score of 94.19% at the 99.9th percentile indicates extremely high exploitation activity despite the moderate severity rating.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| atlassian | jira data center | < 8.5.14; >= 8.6.0, < 8.13.6; >= 8.14.0, < 8.16.1 |
| atlassian | jira server | < 8.5.14; >= 8.6.0, < 8.13.6; >= 8.14.0, < 8.16.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- http://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html(Exploit, Third Party Advisory, VDB Entry)
- https://jira.atlassian.com/browse/JRASERVER-72695(Issue Tracking, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26086(US Government Resource)
Weakness Type
Path Traversal in Jira Server and Data Center
CVE-2021-26086 is a path traversal vulnerability in Atlassian Jira Server and Data Center. Path traversal (also known as directory traversal) occurs when an application uses user-supplied input to construct file paths without properly validating or sanitizing the input, allowing an attacker to access files outside the intended directory. In this case, the vulnerability exists in a specific endpoint that handles requests to web application resources. An attacker can manipulate the request path to escape the intended resource directory and access files such as /WEB-INF/web.xml, which is a Java web application deployment descriptor containing configuration details. While the scope of accessible files is limited compared to unrestricted path traversal vulnerabilities, the exposed files can reveal valuable information about the application's internal architecture and configuration.
Impact Analysis
The impact of CVE-2021-26086 is focused exclusively on confidentiality with a low impact rating. Confidentiality is partially compromised because the path traversal allows reading of specific server files, most notably the web.xml deployment descriptor. This file typically contains servlet mappings, filter configurations, initialization parameters, and potentially security constraint definitions. While this does not directly expose user data or credentials, the information gained can be used to plan more targeted attacks against the Jira instance or its underlying infrastructure.
The integrity and availability of the system are not affected (I:N/A:N), as this vulnerability only enables file reading and does not allow modification of data or disruption of services. The attack requires no privileges (PR:N) and no user interaction (UI:N), and is accessible over the network (AV:N) with low complexity (AC:L), making it trivially exploitable. The extremely high EPSS score of 94.19% at the 99.9th percentile is noteworthy for a medium-severity vulnerability and reflects that the vulnerability is being widely exploited, likely as part of reconnaissance operations to identify vulnerable Jira instances and gather intelligence for more sophisticated follow-up attacks. The ransomware association is listed as unknown.
Exploit Maturity
CVE-2021-26086 demonstrates very high exploit maturity despite its moderate severity rating, as confirmed by its inclusion in CISA's Known Exploited Vulnerabilities catalog and an EPSS score of 94.19% at the 99.9th percentile. This exceptional exploitation rate for a medium-severity information disclosure vulnerability indicates that it is being used extensively in automated scanning and reconnaissance campaigns.
A public exploit is available through PacketStorm Security, which provides a detailed proof-of-concept for the file read vulnerability. Atlassian has documented the issue in their bug tracker at JRASERVER-72695 with the official vendor advisory. The vulnerability's age (disclosed in 2021) combined with its continued active exploitation in 2024 suggests that many Jira instances remain unpatched, making it a reliable target for threat actors. While the ransomware association is unknown, the information gained through this vulnerability can enable more damaging follow-up attacks against the Jira platform or the broader infrastructure.
Remediation
-
Upgrade Jira Server or Data Center to a patched version. Apply the security updates documented in Atlassian's advisory at JRASERVER-72695. For the 8.5.x branch, upgrade to version 8.5.14 or later. For the 8.6.x through 8.13.x branches, upgrade to version 8.13.6 or later. For the 8.14.x through 8.16.x branches, upgrade to version 8.16.1 or later. If possible, upgrade to the latest supported Jira version for comprehensive security coverage.
-
Restrict access to the Jira web interface. Implement network-level access controls to limit who can reach the Jira instance. Use a web application firewall (WAF) or reverse proxy to filter requests containing path traversal patterns such as directory traversal sequences targeting /WEB-INF/ resources.
-
Audit Jira access logs for exploitation attempts. Review web server access logs for requests targeting the /WEB-INF/web.xml path or similar restricted resources. A high volume of such requests may indicate ongoing reconnaissance against your Jira instance. Document any suspicious source IP addresses for threat intelligence purposes.
-
Review exposed configuration for sensitive data. If your Jira instance may have been exploited before patching, review the contents of the web.xml file and any other potentially exposed configuration files to assess what information an attacker could have obtained. Determine whether any sensitive parameters, internal endpoints, or security configurations were revealed that could enable further attacks.
-
Implement defense-in-depth measures. Deploy a web application firewall with rules to block path traversal attempts. Ensure Jira is running with least-privilege file system permissions so that even if path traversal occurs, the accessible files are minimized. Enable access logging and monitoring to detect and respond to exploitation attempts promptly.
Technical Details
CVE-2021-26086 is a path traversal vulnerability in Atlassian Jira Server and Data Center with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, resulting in a base score of 5.3 (Medium). The attack is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N), and needs no user interaction (UI:N). Only confidentiality is impacted, and at a low level (C:L).
The vulnerability exists in the way Jira handles requests for web application resources. The /WEB-INF/ directory in Java web applications contains configuration files and compiled classes that should not be directly accessible to external users. Under normal circumstances, the Java servlet container blocks direct access to this directory. However, a flaw in Jira's request routing allows an attacker to craft a request that bypasses this restriction and retrieves files from the /WEB-INF/ directory, specifically the web.xml deployment descriptor.
The web.xml file is a standard Java web application configuration file that defines servlet mappings, URL patterns, filter chains, security constraints, and initialization parameters. While it does not typically contain credentials directly, it reveals the internal structure of the application, the available endpoints, configured security filters, and other architectural details that are valuable for planning targeted attacks. The scope is unchanged (S:U) and the confidentiality impact is low (C:L), reflecting that the file access is limited rather than providing arbitrary file system read capabilities. Affected versions include Jira Server and Data Center before 8.5.14, from 8.6.0 before 8.13.6, and from 8.14.0 before 8.16.1.
Frequently Asked Questions
What is CVE-2021-26086?
CVE-2021-26086 is a path traversal vulnerability in Atlassian Jira Server and Data Center that allows unauthenticated remote attackers to read specific configuration files, particularly the /WEB-INF/web.xml deployment descriptor. It has a CVSS v3.1 score of 5.3 (Medium).
Why is a medium-severity vulnerability in the CISA KEV catalog?
Despite its moderate CVSS score, CVE-2021-26086 is actively exploited at an extremely high rate, with an EPSS score at the 99.9th percentile. The vulnerability is trivially exploitable, requires no authentication, and is used in widespread automated scanning campaigns. CISA includes vulnerabilities based on confirmed exploitation regardless of severity rating.
What information can an attacker obtain?
The primary target is the web.xml deployment descriptor, which reveals the internal structure of the Jira web application including servlet mappings, URL patterns, filter configurations, and initialization parameters. While this does not directly expose user data, it provides valuable reconnaissance information for planning more targeted attacks.
Is Jira Cloud affected by CVE-2021-26086?
No. CVE-2021-26086 affects only Jira Server and Jira Data Center (self-hosted deployments). Atlassian-hosted Jira Cloud instances are not vulnerable to this specific issue.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.