CVE-2026-124503: sooperset mcp-atlassian io.py validate_safe_path path traversal
A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validatesafepath of the file src/mcpatlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.24.1 is capable of addressing this issue. Upgrading the affected component is recommended. This CVE was requested by the vendor.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sooperset/mcp-atlassianto a version that resolves this vulnerability.Fixed in 0.24.1
Event History
Frequently Asked Questions
Which versions need remediation?
sooperset mcp-atlassian versions up to and including 0.24.0 are affected. Upgrade to version 0.24.1 to address the issue.
What level of access does an attacker need?
The issue can be initiated remotely, but the CVSS vector indicates that the attacker needs low privileges. No user interaction is required.
Is exploitation likely to be practical?
A public exploit is available and may be used. Prioritize upgrading affected deployments, particularly where low-privileged remote access is available.