{"id":"CVE-2019-3398","kind":"vulnerability","aliases":["CVE-2019-3398"],"related":[],"title":"Atlassian Confluence Server and Data Center: Atlassian Confluence Server and Data Center Path Traversal Vulnerability","description":"Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.","summary":"Atlassian Confluence Server and Data Center has a path traversal flaw in its downloadallattachments resource that lets a privileged remote attacker write files anywhere the server can. Writing files can lead to remote code execution on the Confluence host.","severity":"critical","cvss":9.0,"epss":0.97028,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Atlassian Confluence Server and Data Center","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["atlassian","confluence","exploited","self-hosted","vendor"],"not_affected_if":["atlassian-cloud"],"how_to_check":null,"fix":"Apply the Atlassian vendor update for Confluence Server and Data Center per vendor instructions; CISA's required action is to apply updates per vendor instructions. Fixed version: unknown","status":"open","published_at":"2019-04-18T18:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:49+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:33:49Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Atlassian vendor update for Confluence Server and Data Center per vendor instructions; CISA's required action is to apply updates per vendor instructions. Fixed version: unknown","reach":"internet","impact":"high","summary":"Atlassian Confluence Server and Data Center has a path traversal flaw in its downloadallattachments resource that lets a privileged remote attacker write files anywhere the server can. Writing files can lead to remote code execution on the Confluence host.","category":"vendor","who_cares":["confluence","self-hosted","atlassian"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker writes files to server and achieves remote code execution","analyst_note":"Exploited in the wild per CISA KEV; find the fixed Confluence version and a detection method (for example, checking for unexpected files written by downloadallattachments) from the Atlassian security advisory for CVE-2019-3398.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["atlassian-cloud"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":2872,"output_tokens":399,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Exploited in the wild per CISA KEV; find the fixed Confluence version and a detection method (for example, checking for unexpected files written by downloadallattachments) from the Atlassian security advisory for CVE-2019-3398.","search":"'-2019':17A,20A '-3398':18A,21A '2.0.0':158C '6.12':175C '6.12.4':170C '6.13':185C '6.13.0':178C '6.13.4':180C '6.14':195C '6.14.0':188C '6.14.3':190C '6.15.0':199C '6.15.2':201C '6.6':165C '6.6.13':160C '6.7.0':168C 'add':95C 'admin':115C 'affect':203C 'and':25A 'anywher':58B 'arbitrari':130C 'atlassian':1A,7A,22A,28B,35B 'attach':96C 'attack':55B,90C 'blog':101C 'center':6A,12A,27A,40B,78C,151C 'code':68B,137C 'confluenc':2A,8A,29B,36B,72B,74C,147C,155C 'confluence':23A 'creat':104C 'cve':16A,19A 'data':5A,11A,26A,39B,77C,150C 'downloadallattach':48B,86C 'execut':69B,138C 'exploit':30B,121C 'file':57B,63B,128C 'fix':162C,172C,182C,192C 'flaw':45B 'host':33B,73B 'lead':65B,134C 'let':51B 'locat':131C 'new':106C 'page':98C 'path':13A,43B,81C,123C 'permiss':93C,116C 'person':110C 'privileg':53B 'remot':54B,67B,89C,136C 'resourc':49B,87C 'run':142C 'self':32B 'self-host':31B 'server':3A,9A,24A,37B,60B,75C,148C,156C 'space':107C,111C,119C 'system':140C 'travers':14A,44B,82C,124C 'vendor':34B 'version':145C,153C,163C,173C,183C,193C 'vulner':15A,83C,125C,144C,206C 'write':56B,62B,127C 'x':166C,176C,186C,196C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-04-18T18:29:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-3398","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-3398","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2019-3398","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-3398","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-3398","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3398","severity":null,"published_at":"2019-04-18T18:29:00+00:00","modified_at":"2026-06-17T02:35:05+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}