Path Traversal / LFI｜You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence

Welcome back to yet another episode of "security was taken seriously".Being who we are (and constantly being exposed to what we see…), we recognize we have been doomed to eternal damnation as we keep on watching security best practices crumble behind “secure by design”

一、核心思路

• 【方法模板·非来源原文】入口发现：文件下载/预览/模板/日志查看/导出
• 来源链接: https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/
• 分类命中词: {'Path Traversal / LFI': ['path traversal'], 'Information Disclosure': ['exposed'], 'SSRF': ['ssrf'], 'Command Injection / RCE': ['rce']}

二、成立条件

• 【来源原文片段】filePath); <----- [2] } Given the routing patterns we have seen, it is safe to assume that a user-controlled resourceName is pushed to this function and funneled through c
• 【来源原文片段】Jira, Confluence, or Bitbucket to reach Crowd directly. It is probably safe to assume that in real environments you will find both very permissive and locked-down Atlassia

三、验证方法与步骤

• 【方法模板·非来源原文】入口发现：文件下载/预览/模板/日志查看/导出
• 【方法模板·非来源原文】测试变量：../ 层级、编码（%2e%2e/、..%5c）、绝对路径、软链接
• 【方法模板·非来源原文】成功证据：读到本不该读的文件内容（带文件指纹片段）
• 【方法模板·非来源原文】误报过滤：返回错误页/空内容/被 WAF 拦

【缺失】来源未给出可执行复现步骤；需按 test_methodology 在授权靶场自行设计并记录

四、误报排除

• 登录页/统一错误页/WAF 阻断页/缓存页/通用 200 空壳
• 非确定性字段（traceId/timestamp/随机 token）必须先归一化

五、影响与修复

影响：

分类：Path Traversal / LFI；来源严重性：未提供。实际影响需以本地/授权靶场复现结果为准，评分与来源自述不构成影响结论。

修复：

按该类漏洞的通用根因修复（服务端校验/白名单/最小权限），并补充回归测试。

关联：CVE-2026-21589

六、原始来源

https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

---

本文由 QGG 渗透大师自动学习整理：内容取自公开报告，未在未授权目标上做任何验证。