ZeroDay Findings
Sign inSign up

Findings

CVE-2019-3398

Atlassian Confluence Server and Data Center Path Traversal Vulnerability

Published Apr 18, 2019 · updated Jun 16, 2026 · atlassian confluence server

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 18, 2019 · Catalog

    Detected

    Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe atlassian/confluence serverversion unspecified
  • vendor Atlassian Confluence Server and Data Centerversion unspecified

Sources

  • CISA KEVCVE-2019-3398

    Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.

    cisa.gov
  • CVE.orgCVE-2019-3398

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-3398

    30-day exploitation probability 97.0%

    first.org
  • Exploit Database47621

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2019-3398

    Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/152616/Confluence-Server-Data-Center-Path-Traversal.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/155245/Atlassian-Confluence-6.15.1-Directory-Traversal.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References