Path Traversal Vulnerability in MCP Atlassian for Confluence and Jira

CVE-2026-77266

What is CVE-2026-77266?

The MCP Atlassian server for Confluence and Jira contains a vulnerability that allows unauthorized access through the upload_attachment function. This function improperly handles absolute paths and traversal sequences, enabling an attacker with appropriate permissions to access and exfiltrate sensitive server-local files. The flaw resides in the way the path resolution is managed, leading to potential information disclosure risks if not mitigated. The issue has been addressed in version 0.22.0, which introduces necessary restrictions on input handling to enhance security.

References