{"id":"CVE-2021-26086","aliases":["EUVD-2021-12907","GHSA-vvhj-8w7x-qj58"],"status":"published","title":"Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read...","description":"Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.99999,"percentile":0.99993,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2021-08-16T00:15:09Z","modified":"2026-06-17T03:42:50Z","kev":{"date_added":"2024-11-12","due_date":"2024-12-03","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-11-12"},{"source":"kev","since":"2024-11-12"}],"exploits":[{"source":"pocgithub","id":"Jeromeyoung/CVE-2021-26086","title":"Jeromeyoung/CVE-2021-26086","date":"2021-09-05","url":"https://github.com/Jeromeyoung/CVE-2021-26086"},{"source":"pocgithub","id":"ColdFusionX/CVE-2021-26086","title":"ColdFusionX/CVE-2021-26086","date":"2021-10-05","url":"https://github.com/ColdFusionX/CVE-2021-26086"},{"source":"exploitdb","id":"EDB-50380","title":"Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read","type":"webapps","platform":"multiple","date":"2021-10-06","url":"https://www.exploit-db.com/exploits/50380"},{"source":"pocgithub","id":"Official-BlackHat13/CVE-2021-26086","title":"Official-BlackHat13/CVE-2021-26086","date":"2021-11-16","url":"https://github.com/Official-BlackHat13/CVE-2021-26086"},{"source":"nuclei","id":"CVE-2021-26086","title":"Atlassian Jira Limited - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26086.yaml"}],"products":[{"vendor":"atlassian","product":"jira data center"},{"vendor":"atlassian","product":"jira server"},{"vendor":"atlassian","product":"jira server and data center"},{"vendor":"atlassian","product":"jira_data_center"},{"vendor":"atlassian","product":"jira_server"}],"references":[{"url":"https://jira.atlassian.com/browse/JRASERVER-72695","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26086","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26086"},{"url":"https://github.com/advisories/GHSA-vvhj-8w7x-qj58"}],"sources":{"cve":[{"id":"CVE-2021-26086","description":"Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.","status":"published","published":"2021-08-16T00:15:09.827Z","modified":"2025-10-21T23:25:37.96Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-12907","description":"Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.","status":"published","published":"2021-08-16T00:15:09Z","modified":"2025-10-21T23:25:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"exploited_since":"2024-11-12","updated_at":"2026-11-02T20:31:25.901288Z"}],"ghsa":[{"id":"GHSA-vvhj-8w7x-qj58","title":"Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read...","description":"Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.","status":"published","published":"2022-05-24T19:11:20Z","modified":"2025-10-22T00:33:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2021-26086","title":"Atlassian Jira Server and Data Center Path Traversal Vulnerability","description":"Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.","cwes":["CWE-22"],"kev":{"date_added":"2024-11-12","due_date":"2024-12-03","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2021-26086","description":"Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.","status":"published","published":"2021-08-16T01:15:06.353Z","modified":"2026-06-17T03:42:50.11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:56.943671Z"}]}}