File Path Exposure Vulnerability in MCP Atlassian Server for Confluence and Jira

CVE-2026-77270

What is CVE-2026-77270?

The MCP Atlassian Server, used with Atlassian products like Confluence and Jira, is susceptible to a file path exposure vulnerability. This issue arises from the attachment upload tools treating unsanitized caller-controlled file_path values as trusted file paths on the server. Consequently, when users upload attachments, the server can be manipulated to disclose any file that the server process has access to, leading to potential information leakage. This vulnerability affects versions prior to 0.22.0 and has been addressed in the latest release. Ensure your systems are updated to mitigate the risk associated with this vulnerability.

References