{"uuid": "16872415-5409-4cd6-92a6-0ec6edb350ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-21589", "type": "seen", "source": "https://chaos.social/users/christopherkunz/statuses/117398209865608211", "content": "OK, this is an innovative directory traversal vuln:GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1\nThis is from CVE-2026-21589, https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/ \nThe \"::\" gets replaced with \"/\" by some weird sanitation method, read more about it in the writeup.\nTagging @nynbinary for humorous memeing.", "creation_timestamp": "2026-10-07T06:28:45.771244Z"}