Atlassian Confluence Server and Data Center Path Traversal Remote Code Execution Vulnerability (CVE-2019-3398) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAtlassian Confluence Server and Data Center versions from 2.0.0 before 6.15.2
Remote authenticated attackers with attachment or space creation permissions can write arbitrary files to the system, leading to Remote Code Execution (RCE)
Immediately upgrade Confluence Server and Data Center to the patched versions (6.6.13, 6.12.4, 6.13.4, 6.14.3, 6.15.2 or later)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Confluence to a patched release. Below is an example of upgrading Confluence on a Linux server.
# 1. Stop the Confluence service
sudo systemctl stop confluence
# 2. Backup Confluence Home and Installation directories
tar -czvf confluence_home_backup.tar.gz /var/atlassian/application-data/confluence
tar -czvf confluence_install_backup.tar.gz /opt/atlassian/confluence
# 3. Download and run the installer for a patched version (e.g., 6.15.2+)
wget https://www.atlassian.com/software/confluence/downloads/binary/atlassian-confluence-6.15.2-x64.bin
chmod +x atlassian-confluence-6.15.2-x64.bin
sudo ./atlassian-confluence-6.15.2-x64.bin2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, block external access to the vulnerable downloadallattachments endpoint using a reverse proxy like Nginx.
# Add to your Nginx configuration file (/etc/nginx/conf.d/confluence.conf)
server {
listen 80;
server_name confluence.company.local;
# Block access to the vulnerable endpoint
location ~* /downloadallattachments {
deny all;
return 403;
}
location / {
proxy_pass http://127.0.0.1:8090;
proxy_set_header Host $host;
}
}3. Log Audit & IoC Verification Commands
Run the following commands to inspect access logs for directory traversal attempts and scan for unauthorized JSP files in the web root.
# 1. Search access logs for downloadallattachments and path traversal patterns
grep -i 'downloadallattachments' /opt/atlassian/confluence/logs/conf_access_log.* | grep -E '\.\./|%2e%2e'
# 2. Scan the Confluence web directory for recently modified or created JSP files
find /opt/atlassian/confluence/confluence/ -name '*.jsp' -mtime -30 -lsBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2019-3398) is a critical path traversal flaw (CWE-22) located in the downloadallattachments resource of Atlassian Confluence Server and Data Center. The root cause lies in the insufficient validation of file names when Confluence processes and extracts multiple attachments for download. An attacker can exploit this by uploading an attachment with a maliciously crafted filename containing directory traversal sequences (e.g., ../), which are then resolved by the server during file extraction.
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must possess permissions to add attachments to pages/blogs, create a new space, or have administrative privileges for a specific space.
- The attacker uploads a malicious payload (such as a JSP web shell) with a filename manipulated to include traversal paths:
../../../../../../opt/atlassian/confluence/confluence/shell.jsp. - The attacker triggers the extraction process by invoking the
downloadallattachmentsendpoint. - Due to the lack of path sanitization, the application writes the JSP file outside the designated attachment directory and directly into the web application's root directory.
- The attacker accesses the web shell via a direct HTTP request, executing arbitrary system commands with the privileges of the Confluence process.
3. Infrastructure & Business Impact
This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog and has an EPSS score exceeding 0.97, indicating active in-the-wild exploitation. Successful exploitation allows complete compromise of the Confluence host. This can lead to the theft of sensitive intellectual property, corporate wikis, and credentials, as well as lateral movement within the internal enterprise network.
Official Vendor Advisories & References
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
Frequently Asked SecOps Questions (CVE-2019-3398)
FAQQ1. How critical is CVE-2019-3398 and is it actively exploited in the wild?
CVE-2019-3398 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 97.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-3398?
Primary impacted vendors include atlassian across confluence_server, confluence_data_center. Scope summary: Atlassian Confluence Server and Data Center from 2.0.0 before 6.6.13, 6.7.0 before 6.12.4, 6.13.0 before 6.13.4, 6.14.0 before 6.14.3, and 6.15.0 before 6.15.2
Q3. What temporary mitigations or workarounds exist for CVE-2019-3398 before patching?
[Mitigation] Immediately upgrade Confluence Server and Data Center to the patched versions (6.6.13, 6.12.4, 6.13.4, 6.14.3, 6.15.2 or later) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-3398
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (atlassian)
View Category →Atlassian Data Center Arbitrary File Access Vulnerability Advisory (CVE-2026-21589)
[Affected Scope] Wide range of Atlassian Data Center products including Bitbucket, Confluence, Jira, Bamboo, and Crowd.
Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
WebDyne Perl Framework Path Traversal and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-78189)
[Affected Scope] Perl web applications utilizing WebDyne versions 3.007 through 3.021
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.