File Upload Vulnerability in Confluence and Jira by Atlassian

CVE-2026-77259

What is CVE-2026-77259?

The MCP Atlassian server, related to Atlassian products like Confluence and Jira, has a vulnerability that allows a caller to upload files without proper path validation. This flaw enables users to upload sensitive environment files, credentials, or other local data onto a Confluence page. The issue arises from the confluence_upload_attachment function, which does not adequately confirm whether the resolved file path is secured within the designated workspace. This security lapse could lead to exposure of confidential information. The vulnerability has been addressed in the software's version 0.22.0, ensuring safer file handling and compliance with security protocols.

References