← Vulnerability Intelligence

CVE-2019-3398

High 8.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Atlassian Confluence Server and Data Center Path Traversal Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.

Metrics

CVSS 3.1
8.8 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
97% (percentile: 100) as of 2 November 2026
CWE
CWE-22

Affected products

atlassian: confluence server

References