MCP Atlassian EUVD-2026-84629

Requires mcp-atlassian < 0.22.0 where validate_safe_path defaults base_dir to os.getcwd() and the Confluence attachment call sites omit base_dir. The attacker must be a permitted MCP caller (PR:L) able to invoke the Confluence attachment/upload tool with a caller-supplied file_path, typically in a shared-credential or multi-tenant deployment. Code execution is NOT immediate: it is gated on the written file landing in the working-directory root as an importable module name AND the application subsequently importing (or re-importing) that module. Limiting factors: low-privilege tool access is still required (not fully unauthenticated), and successful code execution depends on an import of the overwritten module occurring after the write.

This is a genuine remote-exploitable code-execution path, but its real-world priority is moderated by preconditions. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:N/VA:N/SC:H = 8.3) captures network reachability with low-privilege access and no user interaction, but the IMPACT mapping understates the flaw: an attacker-controlled write that overwrites an importable Python module yields arbitrary CODE EXECUTION, which should register as integrity and availability impact (VI:H/VA:H), not confidentiality-only. So the raw score is arguably conservative rather than inflated. Countervailing the severity: there is NO EPSS score, NO CISA KEV listing, and NO public exploit code identified at time of analysis - the primary evidence is the vendor security advisory (GHSA-6vmq-24h2-pj7j) and the fixing PR/commit. Exploitation is gated on a permitted caller reaching the Confluence attachment tool with shared/operator credentials (PR:L) AND the poisoned module actually being re-imported by the process, so this is targeted, config-dependent exploitation rather than mass-exploitable. Net: a real, patch-now issue for anyone running mcp-atlassian < 0.22.0 in a multi-tenant or shared-credential MCP deployment, but not a widespread wormable threat.

A low-privileged but permitted client of a shared mcp-atlassian server invokes the Confluence upload_attachment tool with a crafted relative file_path that resolves inside the server's working directory, writing or overwriting a Python file that shadows an importable module. When the running application next imports that module, the attacker's code executes in the server process, bypassing the earlier CVE-2026-27825 remediation. No public PoC is currently identified, and the low attack complexity (AC:L) means the write itself is trivial once tool access is obtained.