---
id: "CVE-2019-3398"
kind: "vulnerability"
aliases: ["CVE-2019-3398"]
title: "Atlassian Confluence Server and Data Center: Atlassian Confluence Server and Data Center Path Traversal Vulnerability"
severity: "critical"
cvss: 9.0
epss: 0.97028
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Atlassian Confluence Server and Data Center", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["atlassian", "confluence", "exploited", "self-hosted", "vendor"]
not_affected_if: ["atlassian-cloud"]
published_at: "2019-04-18T18:29:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-3398", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-3398", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3398", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Atlassian Confluence Server and Data Center: Atlassian Confluence Server and Data Center Path Traversal Vulnerability

Atlassian Confluence Server and Data Center has a path traversal flaw in its downloadallattachments resource that lets a privileged remote attacker write files anywhere the server can. Writing files can lead to remote code execution on the Confluence host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Atlassian Confluence Server and Data Center affected ? fixed ?

## Fix

Apply the Atlassian vendor update for Confluence Server and Data Center per vendor instructions; CISA's required action is to apply updates per vendor instructions. Fixed version: unknown

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-3398
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-3398
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-3398

## From the sources

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_