CVE-2019-3396: Atlassian Confluence Widget Connector path traversal and RCE via SSTI

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS score of 9.8, active exploitation in KEV, near-maximum EPSS, and known ransomware use.

What it is

The Widget Connector macro in Atlassian Confluence Server and Data Center fails to safely handle template input, allowing server-side template injection that leads to path traversal and remote code execution. Unauthenticated attackers can reach the vulnerable macro, making this a severe pre-auth flaw for any internet-exposed instance.

Impact

An attacker can execute arbitrary code on the Confluence server, leading to full compromise of the host and any data it holds. This can result in data theft, lateral movement, and ransomware deployment.

Attack surface

Reachable over the network through the Widget Connector macro with no authentication or user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any Confluence Server or Data Center instance exposing the vulnerable macro is at risk.

Exploitation

Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS 30-day probability is 0.99913 (99.967th percentile). Multiple public exploit references exist, including Packet Storm, Exploit-DB, and a Rapid7 Metasploit module.

What to do

• Upgrade Confluence Server/Data Center to a fixed version: 6.6.12, 6.12.3, 6.13.3, or 6.14.2 and later as applicable.
• If immediate patching is not possible, restrict network access to Confluence to trusted users and block external exposure.
• Disable or restrict the Widget Connector macro if it is not required.
• Monitor vendor advisories and apply any additional hardening guidance from Atlassian.
• Review for signs of compromise and rotate credentials if exploitation is suspected.

Detection

• Search Confluence and web server logs for requests to widget connector endpoints containing template syntax or path traversal patterns.
• Monitor for unexpected child processes spawned by the Confluence Java process.
• Alert on outbound network connections from the Confluence host to unusual destinations.
• Use file integrity monitoring on Confluence installation and web directories for unexpected changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.