File Path Vulnerability in MCP Atlassian for Confluence and Jira
CVE-2026-77269

6.5MEDIUM

Key Information:

Vendor

Sooperset

Status
Mcp-atlassian
Vendor
CVE Published:
22 September 2026

What is CVE-2026-77269?

The MCP Atlassian server for Confluence and Jira prior to version 0.22.0 is susceptible to a file path manipulation issue. This vulnerability arises when a user can manipulate the file paths during attachment uploads, leading to potential unauthorized file uploads on the server. Specifically, the vulnerability allows users to specify absolute paths or traverse directories, effectively granting access to local files that should remain protected. The issue has been addressed in version 0.22.0, which implements proper source path constraints to safeguard against such exploitation.

Affected Version(s)

mcp-atlassian < 0.22.0

References

https://github.com/sooperset/mcp-atlassian/security/advis...
x_refsource_CONFIRM
https://github.com/sooperset/mcp-atlassian/pull/1448
x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/commit/b041733...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.