TI-2019-02556 Aliases CVE-2019-3398 GHSA-qv34-rfhx-fg2q

Path traversal in Atlassian Confluence

CRITICAL 97Exploited in the wildCWE-22Published 2019-04-18 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03

EPSS 0.97028 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Confluence (Atlassian): 6.6.13, 6.12.4, 6.13.4 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Atlassian	Confluence	2.0.0 and later; before 6.6.13; 6.7.0 and later; before 6.12.4; 6.13.0 and later; before 6.13.4; 6.14.0 and later; before 6.14.3; 6.15.0 and later; before 6.15.2	6.6.13, 6.12.4, 6.13.4, 6.14.3, 6.15.2	Patch available	CNA

Confluence VendorAtlassian Affected 2.0.0 and later; before 6.6.13; 6.7.0 and later; before 6.12.4; 6.13.0 and later; before 6.13.4; 6.14.0 and later; before 6.14.3; 6.15.0 and later; before 6.15.2 Fixed in 6.6.13, 6.12.4, 6.13.4, 6.14.3, 6.15.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:atlassian:confluence_server::::::::	2.0 to before 6.6.13; 6.7.0 to before 6.12.4; 6.13.0 to before 6.13.4; 6.14.0 to before 6.14.3; 6.15.0 to before 6.15.2	Vulnerable	Atlassian

cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* Versions 2.0 to before 6.6.13; 6.7.0 to before 6.12.4; 6.13.0 to before 6.13.4; 6.14.0 to before 6.14.3; 6.15.0 to before 6.15.2 Vulnerable ·Atlassian

Remediation

Fix · CNA Confluence (Atlassian) Fixed in 6.6.13, 6.12.4, 6.13.4, 6.14.3, 6.15.2

Timeline

2021-11-03 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2019-3398
2026-10-03 Alias added: GHSA-qv34-rfhx-fg2q

References

Exploit 1

http://packetstormsecurity.com/files/155235/Atlassian-Confluence-6.15.1-Directory-Traversal.html

Patch 1

https://jira.atlassian.com/browse/CONFSERVER-58102

Advisory 3

TI-2023-08765 Injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2023-08757 Improper input validation in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2022-09596 Expression language injection in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8
TI-2021-08036 Expression language injection in Atlassian Confluence Server KEVCVSS 3.1CRITICAL 9.8
TI-2019-02554 Path traversal in Atlassian Confluence Server KEVCVSS 3.1CRITICAL 9.8
TI-2023-08759 Incorrect authorization in Atlassian Confluence Data Center KEVCVSS 3.1CRITICAL 9.8

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences