---
id: "CVE-2019-3396"
kind: "vulnerability"
aliases: ["CVE-2019-3396"]
title: "Atlassian Confluence Server and Data Server: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99913
exploited: true
status: "open"
category: "package"
products: [{"name": "Atlassian Confluence Server and Data Server", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["atlassian", "confluence", "exploited", "java", "package", "ransomware", "self-hosted"]
not_affected_if: ["atlassian-cloud", "unaffected-version"]
published_at: "2019-03-25T19:29:01+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-3396", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-3396", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3396", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Atlassian Confluence Server and Data Server: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

Atlassian Confluence Server and Data Center has a server-side template injection flaw in its Widget Connector macro that lets an attacker traverse paths and run code on the server. CISA lists it as actively exploited in the wild, and it has been tied to ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Atlassian Confluence Server and Data Server affected ? fixed ?

## How to check

Check the installed Confluence version under Administration > System Information or the footer of the admin pages; compare against the fixed release in the Atlassian advisory.

## Fix

Upgrade Confluence Server or Data Center to a fixed version per Atlassian's security advisory for CVE-2019-3396.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-3396
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-3396
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-3396

## From the sources

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_