CVE-2019-3398VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2019-3398: Atlassian Confluence Server and Data Center Path Traversal Vulnerability

Affects Atlassian Confluence Server and Data CenterSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 97.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-3398 (opens in a new tab)

Description

CVE-2019-3398 is a path traversal vulnerability in Atlassian Confluence Server and Data Center affecting the downloadallattachments resource. A privileged remote attacker can exploit this flaw to write arbitrary files, potentially leading to remote code execution. This vulnerability has been exploited in the wild and is considered high severity.

Summary

Atlassian Confluence Server and Data Center contain a path traversal vulnerability identified as CVE-2019-3398. The flaw exists in the downloadallattachments resource, allowing a remote attacker with privileges to write files outside the intended directory. Successful exploitation can result in remote code execution on the affected system. This vulnerability has been observed being exploited in the wild, indicating active threat usage.

Impact

Exploitation of this vulnerability allows a privileged remote attacker to write arbitrary files on the server, which can lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected Confluence Server or Data Center instance.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires privileged access, ensure that only trusted users have such privileges and monitor for unusual activity related to file downloads. Follow Atlassian's official advisories for updates and patches.

Weaknesses

CWE-22Path Traversal (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:40:30 UTC

Weaknesses

References

Related threats