An unauthenticated attacker who already knows a file’s exact path can pull it straight out of the web root on eight Atlassian Data Center products, with active exploitation already confirmed.