CVE-2026-77253
Received Received - Intake

Path Traversal in MCP Atlassian Server

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-77253
EUVD
EUVD-2026-84742

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
atlassian mcp_atlassian to 0.22.0 (exc)
atlassian jira to 0.22.0 (exc)
atlassian confluence to 0.22.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77253 is a vulnerability in the MCP Atlassian package (versions before 0.22.0) that allows arbitrary server-local file reads through Jira and Confluence attachment upload tools. The tools accept arbitrary local filesystem paths without validation, enabling attackers to exfiltrate any file readable by the MCP server process to an Atlassian instance.

Detection Guidance

Check if your mcp-atlassian version is below 0.22.0 by running: pip show mcp-atlassian. If installed via source, verify the version in the package metadata. Inspect server logs for unusual attachment uploads or file read attempts targeting sensitive paths like /etc/passwd or .env files.

Impact Analysis

This vulnerability allows attackers to read sensitive files on the server, such as configuration files, credentials, mounted secrets, or source code. If the MCP server is exposed over HTTP, the attack can be performed remotely with only the ability to call attachment or update tools.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. Exposure of credentials or personal data may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade mcp-atlassian to version 0.22.0 or later immediately. Restrict network access to the MCP server to trusted clients only. Review and audit all attachment upload tools and file path inputs for proper validation. Disable unnecessary write tools if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart