EUVD-2026-84630
GHSA-f4p7-qx46-wc5j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain permitted MCP caller access
-
DeliveryCall upload_attachment with sensitive host file_path
-
ExploitServer opens local file unconfined
-
ExecutionUploads file to Atlassian destination
-
ImpactRetrieve attachment and exfiltrate contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an already-permitted MCP caller with access to the Confluence or Jira upload_attachment tool (PR:L - not unauthenticated). The MCP server must be deployed with credentials/host access such that sensitive files exist on its local filesystem, and the attacker must be able to retrieve the resulting Atlassian attachment. The pre-0.22.0 upload_attachment implementations accept an unconstrained file_path and only apply os.path.abspath, performing no workspace confinement - so any server-readable absolute or traversal path is accepted. Exploitation is limited to shared-credential or multi-tenant deployments where a caller's authorized upload capability exceeds intended file-read scope; single-user/local trusted deployments face negligible additional exposure. Impact is confidentiality-only (no write/execute). |
| Impact | This is a genuine but conditionally-gated flaw, not a critical priority. The vendor CVSS 4.0 score is 8.3 (High), driven by VC:H (host file confidentiality loss) plus SC:H (subsequent-system confidentiality impact reflecting exfiltration to an external Atlassian tenant), with PR:L requiring a permitted MCP caller. There is NO EPSS score, NO CISA KEV listing, and NO public proof-of-concept in the provided data - so this is 'no public exploit identified at time of analysis.' The confidentiality-only impact (VI:N/VA:N) means it is an information-disclosure bug, not code execution, distinguishing it from its sibling CVE-2026-77271 (arbitrary-write→RCE) in the same PR#1448 megafix. The key limiting signal is PR:L: exploitation requires an already-authorized MCP caller with attachment-upload access operating against a server that has file-system-readable secrets - realistic in shared-credential/multi-tenant deployments but not remote-unauthenticated. Net: real but bounded risk, appropriately High-not-Critical; the 8.3 reads slightly inflated by SC:H, since my independent 3.1 assessment (single-system C:H only) lands around 6.5. |
| Exploit ScenarioDerived | An MCP caller permitted to use the Confluence or Jira upload_attachment tool supplies a file_path pointing to a sensitive server-local file (e.g. /etc/passwd, ~/.aws/credentials, or the MCP server's own config), which the server dutifully opens and uploads to an attacker-accessible Atlassian page or issue. The attacker then downloads the attachment from Atlassian to read the host file contents. No public POC is identified, but the flaw is mechanically simple: the pre-fix code only called os.path.abspath on the caller-supplied path without confining it to the workspace. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Arbitrary server-local file read and exfiltration in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 lets an authenticated, low-privileged MCP caller abuse the upload_attachment tool for Confluence or Jira to read files on the server host via a caller-supplied file_path, then retrieve the pages' contents as a normal attachment. The vulnerability is CWE-22 (path traversal): the pre-0.22.0 code only normalized the path with os.path.abspath and performed no workspace confinement, so absolute paths and traversal sequences that escape the working directory are accepted. Impact is confidentiality-only (no write or code execution) and exploitation is conditionally gated - it matters primarily in shared-credential or multi-tenant deployments where a caller's legitimate upload capability exceeds its intended file-read scope; single-user, locally trusted deployments face negligible additional exposure. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the vendor fix is available in version 0.22.0.
RemediationAI
Upgrade to MCP Atlassian version 0.22.0 or later (release https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0), which replaces the unsafe os.path.abspath handling in upload_attachment with validate_safe_path and confines upload sources to the server workspace; the change is captured in pull request https://github.com/sooperset/mcp-atlassian/pull/1448 and commit https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460, with full details in advisory GHSA-f4p7-qx46-wc5j. If upgrade is not immediately possible, apply compensating controls rather than relying on generic hardening: run the MCP server as a dedicated unprivileged OS user with a read-only, minimal filesystem footprint and no access to credential stores or home directories (side effect: legitimate attachment uploads from those locations will fail until the upgrade); deploy the server in a container or sandbox that mounts only the directory intended for uploads, which caps exposure to whatever is mounted but requires reworking any workflow that reads files from other paths; and restrict who can reach the MCP endpoint and invoke upload_attachment, removing the tool from shared-credential or multi-tenant deployments where a caller's upload rights exceed its intended read scope (side effect: the attachment-upload feature becomes unavailable to those callers). Note that the same upstream release also hardens outbound HTTP handling against SSRF via redirect validation and DNS pinning, enforces the Confluence spaces_filter allowlist, and blocks Jira attachment downloads into the working-directory root, so upgrading delivers those fixes as well.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MCP Atlassian is a Model Context Protocol (MCP) server that exposes Confluence and Jira operations as tools to MCP clients (typically LLM-driven agents). The affected code lives in the Confluence and Jira upload_attachment implementations: they take a file_path argument supplied by the MCP caller, and the vulnerable versions resolved relative paths with os.path.abspath while accepting any absolute or traversal path without checking that the resolved target stayed inside the intended workspace. This is classic CWE-22 path traversal leading to arbitrary file read - an attacker who can invoke the tool can point file_path at any file the server process can read (for example configuration files, credential stores, or dotfiles on the host), upload it to an Atlassian destination, and then read it back. The upstream fix in version 0.22.0 replaces os.path.abspath with validate_safe_path(file_path), confining the upload source to the working directory and rejecting traversal and escaping absolute paths. The same pull request bundles related hardening (SSRF redirect validation and DNS pinning for outbound HTTP, a mandatory Confluence spaces_filter allowlist that a caller-supplied value may only narrow, and a Jira download_attachment guard preventing writes into the working-directory root), which indicates the maintainers treated attachment handling and request-boundary validation as a cohesive security pass; the CVE itself maps specifically to the unconstrained upload_attachment file_path. The advisory cross-references CVE-2026-27825 as part of tracing the affected entry points and code paths. The independent 3.1 assessment scores this AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. network-reachable but requiring a low-privileged authenticated MCP caller, with confidentiality-only impact.
Know when Mcp Atlassian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Network-reachable MCP tool call by a permitted caller (PR:L, AC:L); arbitrary host-file read yields C:H with no integrity or availability impact; scope-change to the Atlassian tenant is arguable so I keep S:U.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Confluence and Jira upload_attachment implementations accept an unconstrained file_path and open the referenced server-local file. A permitted MCP caller can upload sensitive host files to an Atlassian destination and then retrieve their contents. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Technical POC Analysis
CWE-22 path traversal enabling arbitrary server-local file read in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
MCP Atlassian (sooperset/mcp-atlassian) versions prior to 0.22.0 contain a high-severity path traversal vulnerability (CVE-2026-77260, CVSS 8.3) that allows a caller with upload_attachment privileges to read and exfiltrate arbitrary files from the server host. This primarily affects organizations running shared-credential or multi-tenant deployments of the Confluence/Jira integration, where a low-privileged user could access sensitive server files, though single-user deployments face minimal additional risk. With no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, leadership should prioritize interim mitigations because the flaw can expose credentials, configuration, or intellectual property.
Restrict upload_attachment to trusted users; enforce workspace confinement by validating and restricting file paths to a dedicated directory; run MCP service in a least-privilege container with limited filesystem access; monitor and alert on anomalous file read activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Mcp Atlassian
View allServer-side request forgery in MCP Atlassian (the Model Context Protocol server for Confluence and Jira) prior to 0.22.0
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 applies its ENABLED_TOOLS and TOOLSETS least-privilege filters onl
Path traversal in MCP Atlassian releases prior to 0.22.0 lets a caller of the confluence_upload_attachment MCP tool read
Unauthenticated arbitrary file read in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a remote network calle
Arbitrary local file read leading to data exfiltration affects sooperset's MCP Atlassian server (mcp-atlassian) prior to
Unauthenticated server-local file exfiltration in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a remote
Server-side request forgery in MCP Atlassian prior to 0.22.0 lets an attacker who controls or has already compromised th
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a low-privileged authenticated MCP caller write attacker-chos
Server-side request forgery in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a low-privileged authenticat
Arbitrary local file read in MCP Atlassian (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP caller who can re
Path traversal in the MCP Atlassian server (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP client to read fi
Information disclosure in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows an authenticated caller of the MC
Exploit-DB