---
title: "Confluence pre-auth file read (CVE-2021-26085)"
canonical: https://trickest.com/library/cve-2021-26085-confluence-pre-auth-file-read
description: "Flag Atlassian Confluence hosts for CVE-2021-26085 by reading ajs-version-number on /login.action. Floor is 7.12.3. No /s/ file read."
---

# Confluence pre-auth file read (CVE-2021-26085)

## Overview

This workflow finds Atlassian Confluence Server and Data Center and sorts each host by whether its version falls below the CVE-2021-26085 floor. CVE-2021-26085 is a pre-authentication arbitrary file read through Confluence resource paths. This check never hits `/s/` and never asks the server to return a file. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/login.action` only, fingerprints Confluence from page markers, reads `ajs-version-number`, and compares that number to 7.12.3 in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a version signal only.

Run it on a schedule when Confluence nodes lag just under 7.12.3. A host that stayed on 7.12.2 after the advisory is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/login.action` on each host and fingerprint Confluence from page markers such as `ajs-version-number` and the powered-by footer.
3. Parse the version from `ajs-version-number` and compare it to the CVE-2021-26085 floor in the graph (7.12.3).
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Confluence was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/login.action` only. No `/s/` resource path and no file-read probe.

## Sample output

The records below are illustrative and do not come from a real run. They show one Confluence host below the CVE-2021-26085 floor, one at or above 7.12.3, and one host that is not the product.

```jsonl
{"url": "https://wiki.example.com", "is_product": true, "product_version": "7.12.2", "vulnerable": true, "detail": "below floor 7.12.3"}
{"url": "https://wiki.example.org", "is_product": true, "product_version": "7.12.3", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Atlassian Confluence"}
```

```json
{"cve": "CVE-2021-26085", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Confluence versions does this flag?

Builds below 7.12.3, the single floor coded in the graph. The compare uses the version Confluence itself served on `/login.action`.

### Does an affected row mean a file was read?

No. The check only GETs `/login.action` and reads `ajs-version-number`. It does not hit `/s/` and it does not confirm arbitrary file read.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public login page. It does not fetch application resources or configuration files.

### Does the check need credentials?

No. It fingerprints the public login page the way an external scanner would.

### What is CVE-2021-26085?

Pre-authentication arbitrary file read in Atlassian Confluence Server and Data Center. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Confluence OGNL RCE (CVE-2021-26084)](/library/cve-2021-26084-confluence-ognl-injection-rce). Reach for it when you need the companion OGNL fingerprint from the same era.
- [Confluence SSTI RCE (CVE-2019-3396)](/library/cve-2019-3396-confluence-widget-connector-ssti-rce). Reach for it when you need the earlier Widget Connector fingerprint.
- [Confluence OGNL RCE (CVE-2022-26134)](/library/cve-2022-26134-confluence-ognl-injection-rce). Reach for it when you need the later OGNL path check.

---
_Markdown source of https://trickest.com/library/cve-2021-26085-confluence-pre-auth-file-read._