https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-04T16:47:09.908100+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-77266 CVE-2026-77266 — MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call 2026-10-04T16:47:09.911725+00:00

Affected: sooperset mcp-atlassian

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen server-local file and exfiltrate it through Jira or Confluence. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and path traversal, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.