# CVE-2021-26086

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.

- Page: https://www.vulneraibility.com/cve/CVE-2021-26086
- CVSS: 5.3
- Known exploited: yes, in CISA KEV since 2024-11-12; CISA due date 2024-12-03
- EPSS: 100.00%
- Public exploit code: 1 on Exploit-DB · 3 GitHub proofs of concept · 1 Nuclei template (first 2021-09-05)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2024-11-13)
- Weakness: CWE-22
- Published: 2021-08-16

## Affected versions

- Atlassian Jira Data Center: affected < 8.5.14; >= 8.6.0 and < unspecified; < 8.13.6; >= 8.14.0 and < unspecified; < 8.16.1
- Atlassian Jira Server: affected < 8.5.14; >= 8.6.0 and < unspecified; < 8.13.6; >= 8.14.0 and < unspecified; < 8.16.1

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://jira.atlassian.com/browse/JRASERVER-72695
- [other] http://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26086

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.