On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive information such as configuration files. This directory traversal vulnerability is a little bit different from the textbook case.

Read the full article at SANS Internet Storm Center →