CVE-2026-77266: MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, uploadattachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen server-local file and exfiltrate it through Jira or Confluence. The advisory traces the vulnerable input and processing flow through uploadattachment, filepath, and path traversal, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCP Atlassianto a version that resolves this vulnerability.Fixed in 0.22.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An MCP caller that has attachment access can exploit it. The caller must be able to invoke the upload_attachment tool against the MCP Atlassian server.
What does an attacker need to provide?
The attacker needs to supply a file_path value containing an absolute path or path-traversal sequences. The vulnerable versions do not constrain the resolved path to the server workspace.
What is the impact of successful exploitation?
An attacker can read a chosen file local to the MCP server and exfiltrate its contents through Jira or Confluence attachments. The issue affects confidentiality; no integrity or availability impact is described.
What versions should be remediated?
MCP Atlassian versions before 0.22.0 are affected. Upgrade to version 0.22.0, which fixes the issue.