# CVE-2019-3398: Atlassian Confluence Server and Data Center Path Traversal Vulnerability

Source: https://junglewise.ai/threats/cve-2019-3398-atlassian-confluence-server-and-data-center-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2019-3398 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2021-11-03

Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource. A remote attacker with specific permissions (such as adding attachments or space administration) can exploit this to write files to arbitrary locations, potentially leading to remote code execution.

Technologies: [Atlassian Confluence Server](https://junglewise.ai/threats/technologies/confluence-server), [Atlassian Data Center](https://junglewise.ai/threats/technologies/data-center). Vendors: [Atlassian](https://junglewise.ai/threats/vendors/atlassian).

## Quick answers

**Is CVE-2019-3398 exploited in the wild?** Yes. CVE-2019-3398 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.

**How severe is CVE-2019-3398?** Critical severity, with a CVSS score of 8.8, published 3 November 2021.

**Which products and versions are affected?** Atlassian Confluence Server 2.0.0 to < 6.6.13, 6.7.0 to < 6.12.4, 6.13.0 to < 6.13.4, 6.14.0 to < 6.14.3, 6.15.0 to < 6.15.2; Atlassian Confluence Data Center 2.0.0 to < 6.6.13, 6.7.0 to < 6.12.4, 6.13.0 to < 6.13.4, 6.14.0 to < 6.14.3, 6.15.0 to < 6.15.2.

**Is there a fix for CVE-2019-3398?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-3398 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2019-3398?** Check whether you run Atlassian Confluence Server or Atlassian Data Center. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Atlassian Confluence Server 2.0.0 to < 6.6.13, 6.7.0 to < 6.12.4, 6.13.0 to < 6.13.4, 6.14.0 to < 6.14.3, 6.15.0 to < 6.15.2
- Atlassian Confluence Data Center 2.0.0 to < 6.6.13, 6.7.0 to < 6.12.4, 6.13.0 to < 6.13.4, 6.14.0 to < 6.14.3, 6.15.0 to < 6.15.2

## Timeline

- 2019-04-17: disclosed: Initial public disclosure and bugtraq mailing list entry
- 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2021-11-03: exploited: Confirmed exploited in the wild per CISA KEV catalog

## Related threats

- [Atlassian Jira Server and Data Center Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2021-26086-atlassian-jira-server-and-data-center-path-traversal)
- [Atlassian Confluence Data Center and Server Template Injection Vulnerability](https://junglewise.ai/threats/cve-2023-22527-atlassian-confluence-data-center-and-server-template-injection)
- [Atlassian Confluence Data Center and Server Improper Authorization Vulnerability](https://junglewise.ai/threats/cve-2023-22518-atlassian-confluence-data-center-and-server-improper)
- [Atlassian Confluence Data Center and Server Broken Access Control Vulnerability](https://junglewise.ai/threats/cve-2023-22515-atlassian-confluence-data-center-and-server-broken-access-control)
- [Atlassian Bitbucket Server and Data Center Command Injection Vulnerability](https://junglewise.ai/threats/cve-2022-36804-atlassian-bitbucket-server-and-data-center-command-injection)