CVE-2019-3396

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.

Affected

Atlassian · Confluence Server

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

99.91% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-11-03, used in ransomware campaigns

Nuclei

critical · CWE-22

Published

2019-03-25

Updated

2025-10-21

Proof-of-concept exploits (26)

• http://packetstormsecurity.com/files/152568/Atlassian-Confluence-Widget-Connector-Macro-V…
• http://packetstormsecurity.com/files/161065/Atlassian-Confluence-6.12.1-Template-Injectio…
• http://www.rapid7.com/db/modules/exploit/multi/http/confluence_widget_connector
• 0xNinjaCyclone/cve-2019-33963★ · 2022-01-10
• 46o60/CVE-2019-3396_Confluence0★ · 2021-02-05
• Avento/CVE-2019-3396-Memshell-for-Behinder2★ · 2024-05-21
• JonathanZhou348/CVE-2019-3396TEST0★ · 2020-02-21
• PetrusViet/cve-2019-33962★ · 2021-05-04
• W2Ning/CVE-2019-33960★ · 2019-12-13
• Yt1g3r/CVE-2019-3396_EXP174★ · 2020-10-01
• abdallah-elsharif/cve-2019-33963★ · 2022-01-10
• am6539/CVE-2019-33960★ · 2019-11-21
• dothanthitiendiettiende/CVE-2019-33960★ · 2019-04-09
• jas502n/CVE-2019-3396144★ · 2019-11-01
• kh4sh3i/CVE-2019-33960★ · 2025-09-16
• koamania/confluence_ssrf_malware_cleaner2★ · 2019-04-29
• pyn3rd/CVE-2019-339639★ · 2019-04-10
• quanpt103/CVE-2019-33960★ · 2019-04-10
• s1xg0d/CVE-2019-33960★ · 2019-05-13
• skommando/CVE-2019-3396-confluence-poc0★ · 2019-08-21
• tranphuc2005/NTCS_baocao030★ · 2025-08-30
• vntest11/confluence_CVE-2019-33960★ · 2019-04-28
• x-f1v3/CVE-2019-339622★ · 2019-10-04
• xiaoshuier/CVE-2019-33960★ · 2019-04-09
• yuehanked/cve-2019-33960★ · 2020-11-17
• tranphuc2005/CVE-2019-33960★ · 2025-08-30

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-3396.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/confluence_widget_con…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/46731
• https://www.exploit-db.com/exploits/49465

Vulhub environments (1)

• vulhub/vulhub/tree/master/confluence/CVE-2019-3396

Exploit collections (2)

• confluence-cve-2019-3396-lfi.ymlchaitin/xray
• CVE-2019-3396.yamlzan8in/afrog

Security advisories

• https://jira.atlassian.com/browse/CONFSERVER-57974

References

• CVE Record
• NVD entry

Related

• CVE-2021-38645
• CVE-2023-0669
• CVE-2023-22527
• CVE-2023-32031
• CVE-2023-43208
• CVE-2024-45507