Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://chaos.social/users/christopherkunz/statuses/117398209865608211">Dr. Christopher Kunz (christopherkunz@chaos.social)'s status on Wednesday, 07-Oct-2026 17:13:02 JST</a><a href="https://chaos.social/@christopherkunz" title="christopherkunz@chaos.social"><img src="https://gnusocial.jp/avatar/230467-48-20240109064907.webp" width="48" height="48" alt="Dr. Christopher Kunz" style="position: absolute; left: 0; top: 0;">Dr. Christopher Kunz</a></section><article><p>OK, this is an innovative directory traversal vuln:<br>GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1</p><p>This is from CVE-2026-21589, <a href="https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/" rel="nofollow">https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/</a> </p><p>The "::" gets replaced with "/" by some weird sanitation method, read more about it in the writeup.</p><p>Tagging @nynbinary for humorous memeing.</p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/6737508#notice-13249123">In conversation</a><time datetime="2026-10-07T17:13:02+09:00" title="Wednesday, 07-Oct-2026 17:13:02 JST">about 3 days ago</time> <span>from <span><a href="https://chaos.social/@christopherkunz/117398209865608211" rel="external" title="Sent from chaos.social via ActivityPub">chaos.social</a></span></span><a href="https://chaos.social/@christopherkunz/117398209865608211">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: storage.ghost.io</div><h5><a href="https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/">You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)</a></h5><div> from <span>@chudyPB</span></div></header><div>Welcome back to yet another episode of "security was taken seriously".Being who we are (and constantly being exposed to what we see…), we recognize we have been doomed to eternal damnation as we keep on watching security best practices crumble behind “secure by design” public statements. And in the</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Dr. Christopher Kunz (christopherkunz@chaos.social)'s status on Wednesday, 07-Oct-2026 17:13:02 JST Dr. Christopher Kunz
OK, this is an innovative directory traversal vuln:
GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1
This is from CVE-2026-21589, https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/
The "::" gets replaced with "/" by some weird sanitation method, read more about it in the writeup.
Tagging @nynbinary for humorous memeing.
In conversationabout 3 days ago from chaos.socialpermalink
Attachments
1. Domain not in remote thumbnail source whitelist: storage.ghost.io
  You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)
  from @chudyPB
  Welcome back to yet another episode of "security was taken seriously". Being who we are (and constantly being exposed to what we see…), we recognize we have been doomed to eternal damnation as we keep on watching security best practices crumble behind “secure by design” public statements. And in the

Public

Embed Notice

HTML Code

Corresponding Notice