Actively exploited in the wild

Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

Atlassian - Confluence Server and Data Server · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2019-3396

CriticalCVSS 9.8KEV

Published: 25/03/2019(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

The Widget Connector macro in Atlassian Confluence Server before versions 6.6.12, 6.12.3, 6.13.3, and 6.14.2 allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Risk Assessment

An attacker can gain full control over the Confluence server, potentially leading to data theft, content modification, and service disruption.

Recommendation

Upgrade Confluence Server or Data Center to version 6.6.12, 6.12.3, 6.13.3, 6.14.2, or later. Restrict access to the Widget Connector macro to trusted users only.

Other vulnerabilities in Atlassian Confluence

CVE-2017-7415High
Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource.

Original NVD description (English source)

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.