MCP Atlassian EUVD-2026-84748

Requires the attacker to be a permitted MCP caller able to invoke the attachment-upload tool (upload_attachment) against an MCP Atlassian server older than 0.22.0 configured with valid Confluence/Jira credentials - most impactful in shared-credential or multi-user/HTTP-transport deployments where a client can exercise the server's file system through the operator's credentials. The specific trigger is a caller-supplied absolute or path-traversal file_path to the upload flow, which the vulnerable code only abspath'd rather than validating against the workspace. Limiting factors: exploitation is bounded to files readable by the server process, requires the low-privilege ability to call the tool (PR:L, not fully unauthenticated), and yields confidentiality impact only (no write or availability effect); it is fully mitigated by upgrading to 0.22.0.

This is a genuine but bounded issue best rated MEDIUM. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) is internally consistent with the description: a network-reachable MCP server, low attack complexity, and required low privilege (PR:L) because the attacker must be a permitted MCP client able to invoke the upload_attachment tool against configured Atlassian credentials. Impact is confidentiality-only (C:H, I:N, A:N) - the flaw reads and exfiltrates arbitrary host-readable files but does not modify or crash the system. No EPSS score, no CISA KEV listing, and no public exploit code are provided, so this is no public exploit identified at time of analysis; there is no signal of active or widespread exploitation. Notably, this is explicitly framed as an incomplete-fix/bypass of CVE-2026-27825: that prior remediation constrained download destinations but left upload SOURCE paths (file_path) unvalidated, a classic asymmetric-fix gap confirmed by the vendor advisory and PR diff. Net: real and worth patching for anyone running MCP Atlassian, but not an emergency mass-exploitation candidate given PR:L gating, confidentiality-only impact, and the niche deployment footprint.

An attacker who can reach the MCP Atlassian server as a permitted caller (e.g., through a shared-credential or multi-user MCP deployment) invokes the attachment-upload tool with an absolute or traversal file_path such as '/etc/passwd', '../../.env', or a mounted secrets file. The server reads that local file and uploads it as an attachment to a Confluence page or Jira issue, from which the attacker reads it back, exfiltrating server-side secrets and configuration. No public exploit code is provided, but the technique is trivial given low attack complexity.