CVE-2019-3398
Atlassian Confluence Server and Data Center Path Traversal Vulnerability
Published Apr 18, 2019 · updated Jun 16, 2026 · atlassian confluence server
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
Timeline
Detection, updates, and resolution for this record.
Apr 18, 2019 · Catalog
Detected
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe atlassian/confluence serverversion unspecified
- vendor Atlassian Confluence Server and Data Centerversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2019-3398
Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.
cisa.gov - CVE.orgVulnerability recordCVE-2019-3398
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2019-3398
30-day exploitation probability 97.0%
first.org - Exploit DatabasePublic exploit reference47621
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDVulnerability recordCVE-2019-3398
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/155245/Atlassian-Confluence-6.15.1-Directory-Traversal.html
Packet Storm link already published on the finding.
packetstormsecurity.com