CVE-2026-77270
MCP Atlassian
- Severity
- Medium
- Published
- September 22, 2026
- Last modified
- September 28, 2026
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled file_path values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassian issue or page, allowing an MCP caller with upload access to disclose any file readable by the server process. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, jira_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
- CWE-22 Path traversal
References
- github.comPatch
- github.comIssue TrackingPatch
- github.comRelease Notes
- github.comExploitVendor Advisory
- github.comExploitVendor Advisory
Listed in
More MCP Atlassian CVEs
Validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL authentication flow.
The OAuth error query parameter is passed to CallbackHandler._send_response in oauth_setup.py and interpolated into an HTML page without escaping.
Validate_safe_path defaults its base directory to os.getcwd(), and affected Confluence attachment call sites omit base_dir, allowing attacker-selected writes within the working directory.
The remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads.
The OAuth fallback token directory and JSON file are created without explicit owner-only modes.
The X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by _process_authentication_headers and used to construct Atlassian fetchers without calling validate_url_for_ssrf.