Mcp Atlassian
CVE-2026-27825
CRITICAL
GHSA-xjgw-4wvw-rgm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to MCP server
-
DeliveryCall confluence_download_attachment tool
-
ExploitSupply path traversal in download_path parameter
-
ExecutionWrite malicious attachment content to arbitrary filesystem location
-
ImpactExecute arbitrary code or compromise system integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have local network access to MCP server (AV:A) and valid authentication credentials (PR:L). MCP Atlassian versions prior to 0.17.0 with confluence_download_attachment tool enabled. Confluence attachment upload capability required to stage malicious content. |
| Impact | CVSS 9.0 — Atlassian integration exposes project documentation, issue tracking, and potentially credentials. |
| Exploit ScenarioDerived | An attacker uses path traversal through the MCP server to access restricted Confluence pages or Jira issues. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
MCP Atlassian server has a path traversal vulnerability enabling unauthorized access to Confluence and Jira data outside the intended scope.
Earlier versions of this analysis (1)
Path traversal in MCP Atlassian server exposes Confluence/Jira data.
RemediationAI
Update the MCP server. Validate all path parameters.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MCP Atlassian is an MCP server for Atlassian products. CWE-22 path traversal allows accessing data outside the intended scope.
Know when Mcp Atlassian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the confluence_download_attachment MCP tool accepts a download_path parameter that is written to without any directory boundary enforcement. An attacker who can call this tool and supply or access a Confluence attachment with malicious content can write arbitrary content to any path the server process has write access to. Because the attacker controls both the write destination and the written content (via an uploaded Confluence attachment), this constitutes for arbitrary code execution (for example, writing a valid cron entry to /etc/cron.d/ achieves code execution within one scheduler cycle with no server restart required). Version 0.17.0 fixes the issue.
Executive ViewAI
A critical path traversal vulnerability in MCP Atlassian (CVE-2026-27825) allows attackers to write files outside intended directories, potentially enabling arbitrary file placement and system compromise on servers running affected versions. Organizations using Confluence or Jira integrations with this tool face immediate risk of data breach, malware deployment, and operational disruption until mitigation is implemented.
Disable the confluence_download_attachment MCP tool entirely if not critical to operations; implement strict network segmentation isolating MCP servers; deploy WAF/IPS rules to detect and block directory traversal patterns (../, ..\) in download_path parameters; restrict file write permissions on the MCP server process to a minimal directory; monitor and alert on unexpected file creation outside designated paths; require multi-factor authentication for Atlassian product access; implement endpoint detection and response (EDR) to detect post-exploitation activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in MCP Atlassian Server Vulnerabilities
View all 2More in Mcp Atlassian
View allServer-side request forgery in MCP Atlassian (the Model Context Protocol server for Confluence and Jira) prior to 0.22.0
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 applies its ENABLED_TOOLS and TOOLSETS least-privilege filters onl
Path traversal in MCP Atlassian releases prior to 0.22.0 lets a caller of the confluence_upload_attachment MCP tool read
Unauthenticated arbitrary file read in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a remote network calle
Arbitrary local file read leading to data exfiltration affects sooperset's MCP Atlassian server (mcp-atlassian) prior to
Unauthenticated server-local file exfiltration in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a remote
Server-side request forgery in MCP Atlassian prior to 0.22.0 lets an attacker who controls or has already compromised th
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a low-privileged authenticated MCP caller write attacker-chos
Server-side request forgery in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a low-privileged authenticat
Arbitrary local file read in MCP Atlassian (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP caller who can re
Arbitrary server-local file read and exfiltration in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 lets an aut
Path traversal in the MCP Atlassian server (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP client to read fi
Exploit-DB