AI analysis
Claude Opus · 5 Nov 2026, 10:20 CET
Atlassian Data Center products expose web root files to unauthenticated attackers
An actively exploited flaw in Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye lets unauthenticated attackers read known files in the web application root. Upgrade to Atlassian's listed fix versions immediately.
In plain terms
Several widely used Atlassian self-hosted products have a flaw that lets anyone who can reach the server over the network download certain files without logging in. The affected products are Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. The files involved are those inside the web application root, which is the folder the application serves its pages and resources from. The attacker must already know the exact name and location of the file they want, because the flaw does not let them browse or list folders.
Atlassian notes that in some configurations sensitive files may be reachable this way, which can make the problem serious. CISA has confirmed that attackers are already exploiting it. Any organisation running these products on its own servers, especially if they are reachable from the internet, should treat this as urgent.