CVE-2019-3398 is a path traversal vulnerability in Atlassian Confluence Server and Data Center. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files.
What path traversal means in a Confluence vulnerability
Path traversal is dangerous in a content platform because the application may resolve user-controlled paths outside the intended document area. In Confluence, that can turn a normal attachment-download path into a file write or file access primitive if the request handling logic is flawed.
For administrators, the key point is that this is not just a “bad URL” problem. A traversal flaw can expose application data, configuration, uploaded content, and other server-resident files that were never meant to be reachable through the web interface.
Why this kind of flaw matters in Atlassian Confluence
Confluence is often a high-value collaboration system, which means it may hold documentation, internal processes, operational secrets, and integration material. A traversal weakness in such a platform can therefore have outsized impact even when the vulnerable component looks narrow on paper.
Because the primary definition says the issue affects Confluence Server and Data Center and involves the downloadallattachments resource, readers should think in terms of application reachability, request handling, and whether the platform is exposed to untrusted users or the internet. For a broader view of web application traversal patterns and related abuse paths, see the Web Application Attacks Guide.
When a traversal bug is paired with privileged remote access, the impact can go beyond reading files. It can support writing files into sensitive locations, which may become a stepping stone for persistence, tampering, or follow-on exploitation depending on the deployment and permissions model.
How organisations assess exposure and validate patching
The first exposure check is simple: identify every Confluence Server and Data Center instance, confirm where it sits in the network, and determine whether any instance is externally reachable or reachable by users who should not be trusted to interact with the affected resource path.
Next, compare the deployed product state with vendor advisories and the NIST National Vulnerability Database and the CVE Program record for the identifier. Those sources help confirm the canonical vulnerability record, while Atlassian advisories remain the authority for version-specific remediation details.
Where patching is delayed, organisations should treat the instance as potentially exposed and reduce reachability, restrict administrative and application access, and review whether the vulnerable endpoint can be isolated or temporarily removed from service. A disciplined vulnerability workflow helps here, which is why the Vulnerability Management Guide is a useful companion for asset scoping, prioritisation, and verification.
Detection and post-exploitation review
Detection should focus on signs that the traversal path was exercised, especially unusual requests to attachment-related resources, unexpected file creation or modification, and changes in server-side content that do not align with normal publishing activity. Web application logs, reverse proxy logs, and file integrity signals are all relevant.
After patching, teams should not assume the system was clean merely because the version is fixed. A successful traversal or write primitive may have left modified files, planted web content, altered configuration, or used the platform as a staging point for broader compromise.
That review should include the application layer and the surrounding host, because file-write exploitation often creates evidence outside the original request path. If the instance supports sensitive collaboration data, review whether any stored credentials, session material, or integration secrets could have been reachable through the affected system.
Risk and Threat Considerations
This vulnerability is risky because Confluence commonly concentrates high-value internal content, and a traversal flaw can turn a routine attachment handler into a route for unauthorised file access or file placement. If the instance is internet-facing or reachable by more users than intended, exploitation becomes easier to scale and harder to contain.
Failure mechanism: The attacker abuses path normalisation or insufficient path validation in the downloadallattachments resource to step outside the intended directory and interact with arbitrary files or write locations.
Impact: The result can include disclosure of sensitive files, corruption of application content, persistence through file placement, or a broader compromise chain if the attacker can influence executable or trusted server-side artefacts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V4 — API and Web Service | Path traversal is a web-service input handling flaw in Confluence's request path |
| Recommendation — Validate path handling and canonicalization in the affected web service. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Traversal exploits insufficient validation of user-supplied path data |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection depends on reviewing logs for suspicious file access and write activity | |
| SI-2 — Flaw Remediation | The term is a remediable vulnerability requiring timely correction and verification | |
| Recommendation — Enforce strict validation and canonicalization for all path inputs. Review logs and file activity for signs of exploitation. Track, patch, and verify remediation for the vulnerable Confluence instance. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | This CVE requires vulnerability identification, prioritisation, and remediation control |
| Recommendation — Prioritise and remediate the vulnerable system under technical vulnerability management. | ||
Practitioner Guidance
Why practitioners should care: Treat the issue as an application integrity and exposure problem, not only a patching task. In a platform that stores operational knowledge and internal documents, even limited file access can create a serious downstream security and governance problem.
What to watch for: Prioritise instances with broad user access, external exposure, weak segmentation, or evidence of recent suspicious requests around attachment-download functions. Where a patch cannot be applied immediately, use compensating controls that reduce access and monitor for changes in files that should never be modified through the web layer.
Related resources from NHI Mgmt Group
- CVE-2021-26086 (Atlassian Jira Server and Data Center Path Traversal)
- CVE-2023-22518 (Atlassian Confluence Data Center and Server Improper Authorization)
- CVE-2023-22527 (Atlassian Confluence Data Center and Server Template Injection)
- CVE-2023-22515 (Atlassian Confluence Data Center and Server Broken Access Control)
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org