CVE-2026-77247
Received Received - Intake

Path Traversal in MCP Atlassian Server

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user deployments, a permitted client can disclose host files without shell or direct filesystem access. The advisory traces the vulnerable input and processing flow through AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, file_path, file_paths, and jira update_issue, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-23
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-77247
EUVD
EUVD-2026-84752

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sooperset mcp-atlassian to 0.22.0 (exc)
atlassian jira 0.22.0
atlassian confluence 0.22.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MCP Atlassian versions before 0.22.0. It allows arbitrary server-local file uploads to Jira or Confluence attachments due to unrestricted file_path parameters. The attachment upload tools accept caller-controlled file paths and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment.

Detection Guidance

Check mcp-atlassian package version with pip show mcp-atlassian. If version is below 0.22.0, the system is vulnerable. Inspect MCP server logs for unusual attachment upload tool calls with file paths outside expected directories.

Impact Analysis

In local deployments, it can expose files readable by the user's MCP process. In HTTP/SSE or multi-user deployments, any permitted MCP client can cause the server to read and upload server-local files to Jira or Confluence. Exposed data may include application configuration, secrets, credentials, or other files accessible to the MCP server process.

Mitigation Strategies

Upgrade mcp-atlassian to version 0.22.0 or later immediately. Disable write/upload tools if not required. Restrict MCP client permissions to prevent arbitrary file path access. Use allowlisted upload directories and validate file paths before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77247. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart