Path Traversal Vulnerability in MCP Atlassian Affecting Confluence and Jira
CVE-2026-73496
What is CVE-2026-73496?
The MCP Atlassian server, utilized for framework products like Confluence and Jira, suffers from a path traversal vulnerability. The issue arises from the confluence_upload_attachment and confluence_upload_attachments tools, which allow client-controlled file paths to be processed without proper validation. This flaw enables attackers with write-tool access to upload arbitrary files to the MCP server, potentially disclosing sensitive server files, environment-stored Atlassian credentials, or compromising another tenant's data. This vulnerability does not affect local single-user deployments, which maintain a separate trust boundary, ensuring server execution occurs in the caller's environment. This critical issue was addressed and resolved in version 0.22.0.
Affected Version(s)
mcp-atlassian < 0.22.0