GHSA-qh7q-jmc7-rc7j: sooperset mcp-atlassian io.py validate_safe_path path traversal

Q: Which deployments are affected?

mcp-atlassian versions up to and including 0.24.0 are affected. Version 0.24.1 addresses the issue.

Q: What access does an attacker need to exploit this issue?

The issue may be initiated remotely, but the vector indicates the attacker requires low-level privileges. No user interaction is required.

Q: Is public exploit code available?

Yes. The available information states that a public exploit exists and might be used.

Q: What should teams do if they use an affected version?

Upgrade mcp-atlassian to version 0.24.1. The provided information does not specify an alternative mitigation for environments that cannot immediately upgrade.

Published Nov 10, 2026

Updated

A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validatesafepath of the file src/mcpatlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.24.1 is capable of addressing this issue. Upgrading the affected component is recommended. This CVE was requested by the vendor.

Affected Software

1 affected component

pypi/mcp-atlassian<=0.24.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade sooperset/mcp-atlassian to a version that resolves this vulnerability.
Fixed in 0.24.1

Event History

Nov 10, 2026

CVE Published

via OSV·09:45 AM

Data Sourced

via OSV·09:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

mcp-atlassian versions up to and including 0.24.0 are affected. Version 0.24.1 addresses the issue.

What access does an attacker need to exploit this issue?

The issue may be initiated remotely, but the vector indicates the attacker requires low-level privileges. No user interaction is required.

Is public exploit code available?

Yes. The available information states that a public exploit exists and might be used.

What should teams do if they use an affected version?

Upgrade mcp-atlassian to version 0.24.1. The provided information does not specify an alternative mitigation for environments that cannot immediately upgrade.

GHSA-qh7q-jmc7-rc7j: sooperset mcp-atlassian io.py validate_safe_path path traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

Is public exploit code available?

What should teams do if they use an affected version?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

Is public exploit code available?

What should teams do if they use an affected version?