CVE-2026-77271 in mcp-atlassian
Summary
by MITRE • 09/22/2026
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_safe_path defaults its base directory to os.getcwd(), and affected Confluence attachment call sites omit base_dir, allowing attacker-selected writes within the working directory. This Python module overwrite can provide code execution when the application later imports the modified module, bypassing the remediation tracked as CVE-2026-27825. This issue is fixed in version 0.22.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in MCP Atlassian versions prior to 0.22.0 represents a critical path traversal and arbitrary file write flaw rooted in the improper handling of directory validation logic within the Model Context Protocol server implementation for Atlassian products such as Confluence and Jira. The core technical deficiency lies in the validate_safe_path function, which is designed to ensure that file operations remain confined to an expected base directory to prevent unauthorized access or modification of system files. However, prior to version 0.22.0, this validation routine defaults its base directory parameter to os.getcwd(), which retrieves the current working directory at runtime rather than a fixed, secure application root path. This dynamic defaulting introduces significant ambiguity and risk because the current working directory can vary depending on how the server is invoked or executed by system administrators or automated processes.
This architectural weakness becomes particularly dangerous when combined with specific call sites within the Confluence attachment handling logic that omit the base_dir argument entirely. By failing to explicitly pass a constrained base directory, these code paths rely on the flawed default behavior of validate_safe_path. Consequently, an attacker who can influence the working directory or exploit other vectors to manipulate file system context can direct write operations outside the intended sandboxed area. This allows for arbitrary writes within the broader working directory structure, effectively bypassing the isolation mechanisms that are supposed to protect critical application files from user-controlled input.
The operational impact of this vulnerability extends beyond simple data corruption due to its potential for remote code execution. By overwriting Python module files located in or accessible via the working directory, an attacker can inject malicious code into modules that are subsequently imported by the running Atlassian application instance. When the server loads these compromised modules during normal operation, it executes the injected payload with the privileges of the user account under which the MCP Atlassian service is running. This mechanism effectively bypasses previous remediation efforts tracked as CVE-2026-27825, indicating that earlier fixes may have addressed surface-level path validation without correcting this deeper reliance on dynamic working directory defaults and implicit module loading behaviors.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) due to the ability to inject arbitrary code via file overwrites, as well as CWE-22 Path Traversal allowing access to files outside intended directories. In terms of adversary tactics, it maps to ATT&CK technique T1059 Command and Scripting Interpreter through Python execution and potentially T1105 Ingress Tool Transfer if the attacker uses this vector to deploy additional payloads. The exploitation chain relies on the principle that trusted code imports untrusted or insufficiently validated files, a common pitfall in dynamic language environments where module loading is implicit upon import statements.
To mitigate this risk, organizations must upgrade MCP Atlassian to version 0.22.0 or later immediately, as this release corrects the default base directory logic and ensures that all file validation routines operate against explicit, secure paths rather than mutable working directories. Additionally, administrators should enforce strict service account permissions by running the MCP server with minimal privileges, ensuring that even if a write occurs, it cannot overwrite critical system modules or execute code in sensitive locations. Implementing mandatory input validation for any external parameters influencing file operations and auditing all call sites to ensure explicit base directory specification are essential defensive measures. Regular monitoring of module import paths and integrity checks on Python files within the application runtime environment can also help detect unauthorized modifications before they lead to full system compromise.