CVE-2019-3398: Atlassian Confluence Server path traversal in downloadallattachments

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw allows authenticated remote code execution, is listed in CISA KEV, and has an EPSS probability above 0.96, so it is being actively exploited.

What it is

Confluence Server and Data Center contain a path traversal flaw in the downloadallattachments resource. An attacker with permission to add attachments, create spaces, or hold space Admin rights can write files to arbitrary locations, which can lead to remote code execution. It matters because the required privilege is common in normal Confluence use, and the flaw is listed in CISA KEV with a very high EPSS score.

Impact

An attacker gains arbitrary file write on the Confluence host, which can be leveraged to execute code and take over the server. This can expose or destroy all content and credentials the instance holds.

Attack surface

Reachable over the network through the Confluence web interface; no user interaction is required, but the attacker must hold an authenticated account with attachment, space creation, or space Admin permissions.

Exploitation

CVE-2019-3398 is in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.96837 (99.885th percentile), indicating active exploitation. Public exploit references exist, though no ransomware group is documented as using it.

What to do

• Upgrade Confluence Server and Data Center to a fixed release: 6.6.13, 6.12.4, 6.13.4, 6.14.3, or 6.15.2 and later.
• If immediate patching is not possible, restrict who can add attachments, create spaces, or hold space Admin rights.
• Limit network exposure of Confluence to trusted users and networks.
• Review and remove unnecessary space Admin and attachment permissions from untrusted accounts.
• Monitor vendor advisories for any further guidance on this issue.

Detection

• Review Confluence access logs for requests to the downloadallattachments resource with traversal sequences such as ../ or encoded variants.
• Alert on file writes or new files appearing in web-accessible or unexpected directories on the Confluence host.
• Monitor for unexpected child processes spawned by the Confluence Java process.
• Audit accounts granted attachment, space creation, or space Admin permissions for unexpected changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.