CVE-2019-3396

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

99.91% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-11-03, used in ransomware campaigns

Nuclei

critical · CWE-22

Published

2019-03-25

Updated

2025-10-21

Proof-of-concept exploits (26)

• http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-V…
• http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injectio…
• http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector
• 0xNinjaCyclone/cve-2019-33963★ · 2022-01-10
• 46o60/CVE-2019-3396_Confluence0★ · 2021-02-05
• Avento/CVE-2019-3396-Memshell-for-Behinder2★ · 2024-05-21
• JonathanZhou348/CVE-2019-3396TEST0★ · 2020-02-21
• PetrusViet/cve-2019-33962★ · 2021-05-04
• W2Ning/CVE-2019-33960★ · 2019-12-13
• Yt1g3r/CVE-2019-3396_EXP174★ · 2020-10-01
• abdallah-elsharif/cve-2019-33963★ · 2022-01-10
• am6539/CVE-2019-33960★ · 2019-11-21
• dothanthitiendiettiende/CVE-2019-33960★ · 2019-04-09
• jas502n/CVE-2019-3396145★ · 2019-11-01
• kh4sh3i/CVE-2019-33960★ · 2025-09-16
• koamania/confluence_ssrf_malware_cleaner2★ · 2019-04-29
• pyn3rd/CVE-2019-339639★ · 2019-04-10
• quanpt103/CVE-2019-33960★ · 2019-04-10
• s1xg0d/CVE-2019-33960★ · 2019-05-13
• skommando/CVE-2019-3396-confluence-poc0★ · 2019-08-21
• tranphuc2005/NTCS_baocao030★ · 2025-08-30
• vntest11/confluence_CVE-2019-33960★ · 2019-04-28
• x-f1v3/CVE-2019-339622★ · 2019-10-04
• xiaoshuier/CVE-2019-33960★ · 2019-04-09
• yuehanked/cve-2019-33960★ · 2020-11-17
• tranphuc2005/CVE-2019-3396

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3396.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/confluence_widget_con…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/46731
• https://www.exploit-db.com/exploits/49465

Vulhub environments (1)

• vulhub/vulhub/tree/master/confluence/CVE-2019-3396

Exploit collections (2)

• chaitin/xray/blob/master/pocs/confluence-cve-2019-3396-lfi.yml
• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2019/CVE-2019-3396.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-38645
• CVE-2023-0669
• CVE-2023-22527
• CVE-2023-32031
• CVE-2023-43208
• CVE-2024-45507