They've had a string of script-injection vulnerabilities with similar severity -- the last was less than a year ago: https://confluence.atlassian.com/doc/confl

They've had a string of script-injection vulnerabilities with similar severity -- the last was less than a year ago: https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html https://confluence.atlassian.com/doc/confluence-security-adv... Each time, they patch the particular vulnerable script, but they don't seem to have done anything systematic which would eliminate the entire class of vulnerabilities (like, say, adding taint-checking for unquoted, client-supplied content before running code as an OGNL script). So they keep coming up.