CVE-2026-77266 in mcp-atlassian
Summary
by MITRE • 09/22/2026
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen server-local file and exfiltrate it through Jira or Confluence. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and path traversal, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in MCP Atlassian versions prior to 0.22.0 represents a critical server-side file access flaw rooted in insufficient input validation within the upload_attachment functionality. As a Model Context Protocol server designed for integration with Atlassian products such as Confluence and Jira, this component is responsible for handling file attachments that are subsequently processed by these enterprise platforms. The core technical deficiency lies in the failure to constrain or sanitize absolute paths and directory traversal sequences provided during the attachment upload process. Specifically, when a caller invokes the upload_attachment endpoint, the system accepts the specified file_path without verifying whether it resides within an allowed workspace directory. This lack of path normalization allows attackers to supply maliciously crafted inputs containing characters such as dot-dot-slash or absolute filesystem paths that bypass intended access boundaries.
From a technical perspective, this flaw enables unauthorized read operations on server-local files that are not part of the designated application workspace. By exploiting the absence of strict path containment checks, an attacker can traverse up the directory hierarchy to locate sensitive configuration files, source code, credentials, or other proprietary data stored on the host system. The operational impact is severe because it allows for remote information disclosure without requiring elevated privileges beyond basic attachment access rights. An MCP caller who possesses standard permissions to upload attachments can leverage this vulnerability to exfiltrate arbitrary server-side content through Jira or Confluence interfaces, effectively turning a routine file management feature into a vector for data theft.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within a pathname that can cause the path to resolve outside of the intended directory. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1083: File and Directory Discovery, as it facilitates the enumeration and retrieval of files from the local operating system environment. The exploitation chain typically involves crafting a specific HTTP request or API call that injects traversal sequences into the file_path parameter, causing the underlying server logic to resolve the path incorrectly and return contents from restricted areas rather than rejecting the input outright.
Mitigation strategies primarily involve upgrading to version 0.22.0 of MCP Atlassian, where this issue has been resolved through improved validation mechanisms that enforce strict workspace boundaries for all uploaded files. In environments where immediate patching is not feasible, administrators should implement network-level controls such as web application firewalls configured to detect and block common path traversal patterns in API requests targeting the upload endpoint. Additionally, applying principle of least privilege ensures that service accounts associated with MCP Atlassian operate within restricted filesystem contexts, limiting the potential blast radius even if an attacker successfully exploits this flaw. Regular auditing of file access logs can also help identify anomalous read operations indicative of exploitation attempts before significant data loss occurs.