Arbitrary File Upload Vulnerability in Confluence and Jira by Atlassian

CVE-2026-77253

What is CVE-2026-77253?

The MCP Atlassian server in Jira and Confluence prior to version 0.22.0 allows arbitrary local filesystem paths to be accepted during attachment uploads. This results in potential exposure of sensitive information, including configuration files, credentials, and mounted secrets. The flaw facilitates unauthorized access to files readable by the MCP process, crossing the client-to-server filesystem boundary. This vulnerability has been addressed in version 0.22.0, which enhances input validation and mitigates the associated risks.

References