CVE-2026-77247: MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user deployments, a permitted client can disclose host files without shell or direct filesystem access. The advisory traces the vulnerable input and processing flow through AttachmentsMixin.uploadattachment, AttachmentsMixin.uploadattachments, filepath, filepaths, and jira updateissue, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCP Atlassianto a version that resolves this vulnerability.Fixed in 0.22.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Remote or multi-user MCP Atlassian deployments are exposed when a permitted client can invoke the Jira or Confluence attachment-upload functionality. Such a client may cause the MCP server to read and attach files accessible to the server host without needing shell access or direct filesystem access.
Which operations should be treated as affected during triage?
Affected entry points include AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, file_path, file_paths, and the Jira update_issue flow. These paths process caller-controlled file path arguments on the MCP server before uploading the selected files as attachments.
What version resolves the issue?
Upgrade MCP Atlassian to version 0.22.0. Versions prior to 0.22.0 are affected.