CVE-2026-77258
highMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).
Vendor / product: Mcp-atlassian — mcp atlassian
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment in src/mcp_atlassian/confluence/attachments.py accepts a caller-controlled file_path and opens the selected server-local file without restricting it to the workspace. A permitted Confluence MCP caller can upload the file as an attachment and disclose data readable by the server process. This issue is fixed in version 0.22.0.
CVSS
7.7
7.7 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-09-22 18:17
Modified: 2026-09-29 14:01
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 06:55 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
mcp-atlassian / mcp_atlassian <0.22.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
Patch / mitigation: https://github.com/sooperset/mcp-atlassian/pull/1448
References
- https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 security-advisories@github.com
- https://github.com/sooperset/mcp-atlassian/pull/1448 security-advisories@github.com
- https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 security-advisories@github.com
- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-93xw-j965-9mx3 security-advisories@github.com
- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-93xw-j965-9mx3 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:55 UTC · record ↗