CVE-2026-77258
EUVD-2026-8465022.09.2026, 18:17
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment in src/mcp_atlassian/confluence/attachments.py accepts a caller-controlled file_path and opens the selected server-local file without restricting it to the workspace. A permitted Confluence MCP caller can upload the file as an attachment and disclose data readable by the server process. This issue is fixed in version 0.22.0.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| mcp-atlassian | mcp_atlassian | 𝑥 < 0.22.0 |
𝑥
= Vulnerable software versions
References