{"vulnerability": "CVE-2026-27825", "sightings": [{"uuid": "57297c12-61ec-45aa-899b-4b2dc0686b71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://gist.github.com/alon710/318772c839d4af9a91549fceab76247e", "content": "", "creation_timestamp": "2026-03-10T19:10:06.000000Z"}, {"uuid": "0ac1f387-a410-4fa1-a61f-42b6d2bbafc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://gist.github.com/alon710/466922a78fd1f1a990595c00598870a1", "content": "", "creation_timestamp": "2026-03-10T19:40:06.000000Z"}, {"uuid": "74ab4f70-2db1-4e8e-98f0-07eec85fd1c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mijhumw7dl27", "content": "", "creation_timestamp": "2026-04-02T15:00:15.189968Z"}, {"uuid": "8a6de9d2-9e83-4687-95ce-093d07562e10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mjoc6cjsrh22", "content": "", "creation_timestamp": "2026-04-17T06:26:47.733286Z"}, {"uuid": "0ed15bdc-fdd3-4cdc-8183-a846bdf37cc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://t.me/GithubRedTeam/82101", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-27825\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a romain-deperne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-29 21:58:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPath Traversal in mcp-atlassian via zip extraction in upload_attachment \u2014 CVSS 9.3\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-29T22:00:04.000000Z"}, {"uuid": "6a6368c0-0494-46bf-af9b-5f3da8f810f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://swecyb.com/ap/users/116080658609901341/statuses/116536100010719335", "content": "(bishopfox.com) SSRF and Token Passthrough in MCP Servers: Old Vulnerabilities in New Integrations\nCritical SSRF-to-RCE chain (CVE-2026-27826) in mcp-atlassian highlights resurgent risks in MCP server integrations. Attackers exploit lax URL validation to access internal systems, cloud metadata, or achieve RCE via path traversal (CVE-2026-27825).\nIn brief - SSRF and token passthrough vulnerabilities in MCP servers (e.g., Atlassian, Microsoft) enable unauthorized access to internal resources, credential exfiltration, and RCE. Mitigations include strict destination validation and network segmentation.\nTechnically - MCP servers accepting arbitrary URIs without validation (e.g., mcp-atlassian\u2019s custom header injection) allow SSRF targeting localhost/cloud metadata (AWS 169.254.169.254). Token passthrough flaws violate OAuth principles, enabling security control bypass. Mitigations: block private IP ranges, enforce allowlists, and adopt RFC 8693 for scoped token exchange.\nSource: https://bishopfox.com/blog/otto-support-ssrf-token-passthrough-with-mcp\n#Cybersecurity #ThreatIntel", "creation_timestamp": "2026-05-08T02:20:59.164474Z"}, {"uuid": "a747348f-96cd-4a82-bac7-66a918de0607", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://gist.github.com/Harmenszoon/81518d49d6a29b739782db9f1a603fd6", "content": "# Security Report: Path traversal in `fetch_config` MCP tool \u2014 arbitrary directory deletion, repository destruction, and attacker-controlled content at any filesystem path\n\n**Target:** [yusufkaraaslan/Skill_Seekers](https://github.com/yusufkaraaslan/Skill_Seekers)\n(~14.7k stars; PyPI package `skill-seekers`; ships a FastMCP server and a\nlegacy MCP server \u2014 both affected, same root cause)\n\n**Affected versions:** >= 2.2.0 (git URL mode introduced in\n[v2.2.0, 2025-12-21](https://github.com/yusufkaraaslan/Skill_Seekers/releases/tag/v2.2.0)),\nthrough current `3.9.1` / `3.10.0.dev0` at HEAD (`f3972ef`). No fix exists as of\nthis report.\n\n**CWE-22** \u2014 Improper Limitation of a Pathname to a Restricted Directory\n\n**Severity:** deployment-dependent (see \u00a77 for derivation and per-deployment\ntable). On the shipped Docker/HTTP deployment (binds `0.0.0.0:8765` by\ndefault, no transport authentication):\n**CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H = 9.1 Critical**.\nOn a local stdio deployment, reachable via prompt injection -> agent tool\ncall: **8.0 High** (`UI:R`).\n\n**Status:** Confirmed by an offline, sandboxed PoC (\u00a78) verified on **both\nWindows 11 (Python 3.11, git 2.52) and Ubuntu/WSL (Python 3.14, git 2.53)**,\ndriving the real `fetch_config` tool. Not yet reported to the maintainer.\n\n---\n\n## 1. Root cause\n\nThe `fetch_config` MCP tool's *git URL mode* passes the raw, unvalidated\n`config_name` tool argument into a filesystem path with no containment\ncheck:\n\n```python\n# src/skill_seekers/mcp/tools/source_tools.py  (fetch_config_tool, MODE 2)\n# identical pattern in the legacy server: src/skill_seekers/mcp/server_legacy.py:1289\nsource_name_temp = f\"temp_{config_name}\"          # config_name = raw MCP tool arg\nrepo_path = git_repo.clone_or_pull(source_name=source_name_temp, ...)\n\n# src/skill_seekers/services/git_repo.py  (clone_or_pull)\nrepo_path = self.cache_dir / source_name          # lines 71-75: no validation; ../ escapes cache\nif force_refresh and repo_path.exists():\n    shutil.rmtree(repo_path)                      # delete primitive (B)\ntry:\n    if repo_path.exists() and (repo_path / \".git\").exists():\n        ...\n        if token:\n            origin.set_url(clone_url)              # attacker URL replaces origin\n        origin.pull(branch)\n        ...\n        git.Repo.clone_from(clone_url, repo_path, ...)   # write primitive (A)\n    except (InvalidGitRepositoryError, GitCommandError):\n        shutil.rmtree(repo_path)                  # delete primitive (C), lines 96-98\n```\n\nA crafted `config_name` such as `x/../../` (any name resolving\n`cache_dir / f\"temp_{config_name}\"` outside the cache; on Windows the name must\nnot *begin* with `..` because the literal `temp_..` prefix would form an\ninvalid directory name \u2014 `x/../` works as the head segment) escapes the cache\ndirectory. Every branch of `clone_or_pull` reached this way is either\ndestructive or attacker-controlled. All damage is bounded by the permissions\nof the server process.\n\n## 2. Wire reachability (verified in both servers)\n\nThis is not an internal-only API. Every attack parameter is in the tool schema\nthat MCP clients see \u2014 in **both** shipped servers:\n\n* FastMCP (registered tool): `src/skill_seekers/mcp/server_fastmcp.py:1080-1089`\n  \u2014 `config_name: str | None`, `git_url: str | None`, `branch: str = \"main\"`,\n  `token: str | None`, `refresh: bool = False`.\n* Legacy server (advertised `inputSchema`): `server_legacy.py:394-441`\n  \u2014 same five properties in the JSON schema, `\"required\": []`.\n\nTwo attack paths, two deployments:\n\n* **Remote, unauthenticated (Docker/HTTP).** `Dockerfile.mcp` runs HTTP mode\n  **by default**, binds **`0.0.0.0`** (`CMD ... --http --host 0.0.0.0 --port\n  ${PORT:-${MCP_PORT:-8765}}`), is built for cloud platforms (\"Cloud platforms\n  (Render, Railway, etc. set `$PORT` automatically)\"), and ships **no\n  authentication** on the transport. Anyone who can reach the port calls\n  `fetch_config` directly \u2014 no prompt injection, no user interaction.\n* **Local (stdio default).** The canonical 2026 MCP attack applies \u2014 prompt\n  injection into content the agent ingests (Skill Seekers' core use case is\n  scraping untrusted web pages and cloning repos) steers the agent to call\n  `fetch_config` with attacker-chosen arguments. This threat model is\n  established for MCP servers of this class (CVE-2026-27825; the project has\n  already accepted it \u2014 see \u00a74 precedent), and `README.md` explicitly pitches\n  remote usage: `--transport http --port 8765` + \"Then just ask your\n  assistant\".\n\n`validate_git_url` (git_repo.py:249-273) accepts any `http://` or `https://`\nURL with a hostname and path (attacker-controlled content source, even\nplaintext HTTP), SSH `git@` URLs, and `file://` \u2014 it constrains nothing that\nmatters here.\n\n## 3. Confirmed primitives (each PoC-verified on Windows and Ubuntu/WSL)\n\n**A. Arbitrary directory write \u2014 attacker repo cloned to any nonexistent or\nempty path.** `git.Repo.clone_from` clones an attacker-chosen repository \u2014\nattacker-chosen *contents and filenames* \u2014 to any path the process can write.\n(Precondition: target absent or empty \u2014 `git` refuses to clone into an\nexisting non-empty directory; existing non-empty targets are handled by B/C.)\n\n**B. Arbitrary directory delete + replace \u2014 `refresh=true` + existing\ntarget.** `shutil.rmtree` destroys any existing directory, then\n`clone_from` refills it with attacker content. This is also the bypass for\ngit's refuse-nonempty-directory behavior in A. PoC: victim directory\n`['db.sqlite', 'important.txt']` -> `['.git', 'ext.js', 'package.json']`.\n\n**C. Any existing git repository at the traversed path is destroyed \u2014\n`refresh` NOT required.** When the target exists with a `.git` directory,\n`clone_or_pull` takes the pull branch: with any non-None `token`\n(wire-reachable), `origin.set_url(attacker URL)` runs, then `origin.pull`.\nThat pull reliably fails against an attacker repository (unrelated\nhistories / unborn HEAD), and the `except (InvalidGitRepositoryError,\nGitCommandError)` handler at **git_repo.py:96-98 unconditionally runs\n`shutil.rmtree(repo_path)`** \u2014 the victim's repository is destroyed:\n\n* **C1 \u2014 unborn repo** (`git init`, no commits): on POSIX the attacker's\n  repository is **checked out inside the victim's repo** (observed live:\n  attacker commit + `FETCH_HEAD` + `refs/remotes/origin/main` inside the\n  victim's `.git`); on Windows the pull fails and the repo is **deleted**.\n* **C2 \u2014 committed repo with real work**: pull fails (unrelated histories)\n  -> rmtree. **POSIX: repository fully deleted.** **Windows: rmtree aborts at\n  git's read-only object files mid-deletion \u2014 worktree files may survive\n  while `.git` is gutted** (PoC: `README.md` present, **22/26** `.git` files\n  missing \u2014 the history is unrecoverable).\n\nThe attack surface for C is every git repository at a guessable path\n(`~/src/`, `~/.config/` checkouts, deployment dirs), reachable\nthrough a tool whose documented purpose is fetching configuration.\n\n**Damage boundary:** all primitives are bounded by the server process's\npermissions \u2014 non-root user `mcp` in the Docker image, the invoking user\nelsewhere. In the Docker deployment, host-mounted volumes\n(`VOLUME [\"/data\", ...]` plus cloud-platform mounts) are legitimate targets\nfor both destruction (B/C) and writes (A); *within* the container there is\nno VSCode/Claude to auto-load planted content, so the chains below apply to\nhost/non-containerized deployments (or volume-mounted paths the host loads\nfrom).\n\n## 4. Precedent and contrast: this is a bug, not a design choice\n\n* **Accepted threat model.** The identical CWE-22 pattern in this project's\n  `workflow_tools.py` was reported as a security bug (issue\n  [#325](https://github.com/yusufkaraaslan/Skill_Seekers/issues/325), March\n  2026, \"Severity: High\", same CWE, same primitives: \"read, create,\n  overwrite, or delete arbitrary files\") and fixed by the maintainer in PR\n  #326 (+ follow-up `6beff3d`, 6 regression tests, public thanks to the\n  reporter). The git-tools surface shipped the same class in v2.2.0 and was\n  missed.\n* **The input class is validated elsewhere.** `ConfigPublisher.publish`\n  (backing the `push_config` MCP tool) validates this exact input:\n\n  ```python\n  # src/skill_seekers/services/config_publisher.py:125-130\n  # Validate config_name to prevent path traversal\n  if \"/\" in config_name or \"\\\\\" in config_name or \"..\" in config_name:\n      raise ValueError(\n          f\"Invalid config name '{config_name}'. \"\n          \"Path separators (/, \\\\) and traversal sequences (..) are not allowed.\"\n      )\n  ```\n\n  and resolves `source_name` through the registry\n  (`SourceManager.add_source` itself rejects anything but\n  `[a-zA-Z0-9_-]`, source_manager.py:69). `fetch_config` MODE 1 (named\n  sources) inherits that safety; MODE 2 (git URL) bypasses it.\n\n## 5. Secondary: write-side join `destination / config_name`\n\nBoth servers compute `config_file = Path(destination) / f\"{config_name}.json\"`\nand write the fetched config there. This join traverses identically, but is\ncurrently *gated*: it is reached only after `get_config()` succeeds, and\n`get_config` matches by basename (`config_path.name == config_name`), so a\ntraversal-bearing name raises `FileNotFoundError` before the write. Not\nindependently exploitable today; the recommended fix should cover this join\nso a future change to name matching cannot re-open it. No confidentiality\nprimitive is confirmed (the tool returns paths, not victim file contents),\nhence C:N in the CVSS vector.\n\n## 6. Suggested fix\n\nSingle choke point plus defense in depth, mirroring `_validate_name` from\nPR #326 (reuse it, moved to a shared helper):\n\n```python\ndef _safe_path_segment(name: str) -> bool:\n    \"\"\"True if `name` can be used as a single filesystem path segment.\"\"\"\n    return (\n        bool(name)\n        and not name.startswith(\".\")            # no hidden dirs / '..' prefix\n        and \"/\" not in name and \"\\\\\" not in name\n        and \":\" not in name                      # no drive letters / suffix hacks\n        and \"..\" not in name\n    )\n```\n\n1. **`GitConfigRepo.clone_or_pull`** (root cause): reject `source_name`\n   failing the segment check *before* constructing `repo_path` \u2014 protects\n   every caller, present and future.\n2. **`fetch_config_tool` / legacy MODE 2**: validate `config_name` before\n   building `source_name_temp` and before the `config_file` join (\u00a75).\n3. **Regression tests** mirroring the PoC: escape via `x/../` head segment\n   (must work on Windows \u2014 a leading `..` is invalid there once prefixed\n   with `temp_`), rmtree-then-replace with `refresh=true` (B), pull-failure\n   rmtree of an existing repo without `refresh` (C), extension-directory\n   planting (A), and the `config_file` join.\n\n## 7. Severity derivation\n\nPrimary vector, shipped Docker/HTTP default deployment (0.0.0.0:8765, no\ntransport auth):\n\n```\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H  =  9.1 Critical\n(ISS 0.806; Impact 5.18; Exploitability 3.90)\n```\n\n* **AV:N** \u2014 the Docker image binds 0.0.0.0 by default and is built for cloud\n  deployment; the tool is callable by any network peer.\n* **AC:L** \u2014 one tool call; `validate_git_url` accepts plain `http://`, so\n  the content source is trivially attacker-controlled.\n* **PR:N / UI:N** \u2014 no transport auth, no user interaction on the HTTP path.\n* **C:N** \u2014 no read/disclosure primitive confirmed (\u00a75).\n* **I:H / A:H** \u2014 attacker-chosen content written to arbitrary paths\n  (integrity: A, and C1's POSIX checkout); arbitrary directory and\n  repository destruction (availability: B, C2).\n* **S:U** \u2014 conservative. S:C is arguable for host-mounted-volume impact and\n  would give 9.7; C:H would give 9.8 if a read primitive is later found.\n\nPer-deployment table:\n\n| Deployment | Vector | Score |\n|---|---|---|\n| Docker/HTTP default (0.0.0.0, no auth) | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | **9.1 Critical** |\n| stdio + prompt injection -> tool call | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | **8.0 High** |\n| Same, additionally treating the injection as requiring local presence | AV:L/AC:L/PR:N/UI:R/... | 7.8 High |\n\nComparison: CVE-2026-27825 (mcp-atlassian; same CWE-22 class, same\nunauthenticated-HTTP deployment, write primitive -> code execution) was\nrated **9.1 Critical** and became the highest-profile MCP CVE of H1 2026\n(\"MCPwnfluence\", Pluto Security).\n\n## 8. PoC\n\n`poc_skillseekers_traversal.py` (this directory). Requirements: Python\n3.11+, `GitPython`, `httpx`, `requests`, `pyyaml` (transitively imported);\nrepo checked out at `./skill-seekers`. Offline (`file://` attacker repo \u2014\na benign local fixture, no live infrastructure) and fully sandboxed (own\ntemp workspace, no writes outside it).\n\n* Drives the **real tool implementation path**: the registered FastMCP tool\n  `fetch_config` calls `fetch_config_tool` (server_fastmcp.py:1125) \u2014 the\n  PoC calls `fetch_config_tool` directly. It does *not* drive the JSON-RPC\n  wire transport; wire reachability is established separately in \u00a72 (tool\n  schema in both servers).\n* Asserts on **filesystem state**, never on tool success (a tool \"\u274c\"\n  response is expected \u2014 destruction happens before the config-lookup error\n  returns): canary markers must exist/be gone, and `.git` inventories are\n  compared before/after.\n* Verified on **Windows 11 (Python 3.11, git 2.52) and Ubuntu/WSL\n  (Python 3.14, git 2.53)** \u2014 platform-divergent outcomes (C1) are asserted\n  per-platform. Exits non-zero on any assertion failure.\n\n```\n> python poc_skillseekers_traversal.py\n[attack A] attacker file planted OUTSIDE cache: True -> ...victim\\.vscode\\extensions\\evil-1.0.0\\ext.js\n[attack B] before: ['db.sqlite', 'important.txt']  -> after: ['.git', 'ext.js', 'package.json']\n[attack C1] unborn repo: DELETED (Windows) / attacker checkout inside it (POSIX)\n[attack C2] committed repo: README present, 22/26 .git files missing (Windows);\n            fully deleted (POSIX)\nCONFIRMED: fetch_config config_name path traversal (git_repo.clone_or_pull)\n```\n\n## 9. Escalation analysis (not PoC-demonstrated)\n\nOn **host / non-containerized** deployments (or volume paths the host loads\nfrom), primitive A is a *file-placement attack* \u2014 contingent on later user\naction, not code execution at clone time (git transfers no hooks' execution;\n`clone_from` writes files only):\n\n* VSCode extension drop: `~/.vscode/extensions/-1.0.0/` with\n  `package.json` (`activationEvents: [\"*\"]`) + `ext.js` executes on next\n  VSCode start. (Genuine, reviewed extensions require the VSIX-signing\n  path; sideloaded folders do not.)\n* Claude skill drop: `~/.claude/skills//` (SKILL.md + scripts are\n  loaded by Claude Code on the next session).\n* Any interpreter start-up path writable to the user (`sitecustomize.py`,\n  `PYTHONPATH` entries, `*.zshrc`-adjacent paths).\n\nThese are labeled analysis: the PoC demonstrates the placement (attack A\nplants exactly such an extension), while the *load-time* behavior belongs\nto the host applications and is not tested here. In the container deployment\nthe same primitive targets mounted volumes instead.\n\n## 10. Affected call sites\n\n| Location | Role |\n|---|---|\n| `src/skill_seekers/services/git_repo.py:71-75, 96-98` | **Root cause** \u2014 unvalidated `cache_dir / source_name`; two `shutil.rmtree` sites; `set_url`+`pull`; `clone_from`. (`mcp/git_repo.py` is a re-export of this module.) |\n| `src/skill_seekers/mcp/tools/source_tools.py` \u2014 `fetch_config_tool` MODE 2 (line 184) | `source_name_temp = f\"temp_{config_name}\"` |\n| `src/skill_seekers/mcp/server_legacy.py:1289` \u2014 MODE 2 | identical `temp_{config_name}` pattern |\n| `source_tools.py` / `server_legacy.py` \u2014 `config_file = dest_path / f\"{config_name}.json\"` | same-class write-side join (\u00a75) |\n\n## 11. Disclosure plan\n\n1. **Private channel first.** Check\n   `https://github.com/yusufkaraaslan/Skill_Seekers/security/advisories/new`\n   (GitHub private vulnerability reporting is often enabled even without a\n   SECURITY.md; none exists in the repo). If available: submit privately,\n   request an advisory + CVE. Do **not** open a public issue or a public\n   \"fix traversal\" PR before coordination \u2014 that burns the embargo.\n2. **If private reporting is unavailable:** the maintainer's precedent\n   (#325 -> same-day public fix, public credit, tests) makes a\n   security-labeled public issue acceptable. Mirror the #325 report's\n   structure (Summary / CWE / Severity / File / Impact / PoC / Suggested\n   fix), cite #325/#326 as accepted precedent, offer the PoC + this document.\n3. **Post-fix:** publish a writeup on the missed-sibling pattern \u2014 #326\n   fixed `workflow_tools`; `fetch_config`/`git_repo` shipped the same class\n   in v2.2.0 and was missed; `push_config` even contained the right\n   validation (\u00a74). This plus the disclosure is the CVE-track artifact for\n   the Anthropic Fellows (AI Security workstream) application, whose stated\n   standout criteria are \"reported CVEs or been awarded bug bounty\n   vulnerabilities\" and \"experience with pentesting, vulnerability research\".\n\n## 12. Honesty notes / open caveats\n\n* Severity is **deployment-dependent** (table in \u00a77); 9.1 applies to the\n  shipped Docker/HTTP default, 8.0 to the local prompt-injection model.\n* The escalation chains (\u00a79) are file-placement analysis, contingent on host\n  application behavior \u2014 *not* demonstrated RCE, and they do not apply\n  inside the default container (no host apps there; mounted volumes are the\n  in-container target instead).\n* No confidentiality primitive is confirmed; C:N is deliberate. Finding one\n  (e.g. via the \u00a75 join) would raise the score.\n* The introduction commit was not identified (shallow local history); the\n  v2.2.0 release notes and CHANGELOG pin git URL mode to v2.2.0, bounding\n  the affected range from below.\n* The PoC drives the tool implementation path, not the JSON-RPC transport;\n  wire reachability is established from both servers' schemas (\u00a72), not by\n  an over-the-wire call.\n* CVE likelihood is high but not guaranteed: the maintainer's #325 precedent\n  was handled as a public issue + fix **without** a CVE. If the CVE matters,\n  the private advisory path (11.1) is the route \u2014 GitHub's CNA flow attaches\n  one to the advisory.\n", "creation_timestamp": "2026-08-30T20:16:34.489703Z"}, {"uuid": "b87e4258-806c-49dc-bbe3-854fe2891201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-27825", "type": "published-proof-of-concept", "source": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-xjgw-4wvw-rgm4", "content": "", "creation_timestamp": "2026-02-24T11:57:12.000000Z"}, {"uuid": "fc34650f-8aee-4f81-8fbc-541c0829fc83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/388", "content": "CVE-2026-27825\n\nMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the confluence_download_attachment MCP tool accepts a download_path parameter that is written to without any directory boundary enforcement. An attacker who can call this tool and supply or access a Confluence attachment with malicious content can write arbitrary content to any path the server process has write access to. Because the attacker controls both the write destination and the written content (via an uploaded Confluence attachment), this constitutes for arbitrary code execution (for example, writing a valid cron entry to /etc/cron.d/ achieves code execution within one scheduler cycle with no server restart required). Version 0.17.0 fixes the issue.", "creation_timestamp": "2026-08-28T00:00:32.111275Z"}, {"uuid": "b2315010-70cf-4964-9a16-e90ee53e98a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27825", "type": "seen", "source": "https://t.me/cve0day/388", "content": "CVE-2026-27825\n\nMCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the confluence_download_attachment MCP tool accepts a download_path parameter that is written to without any directory boundary enforcement. An attacker who can call this tool and supply or access a Confluence attachment with malicious content can write arbitrary content to any path the server process has write access to. Because the attacker controls both the write destination and the written content (via an uploaded Confluence attachment), this constitutes for arbitrary code execution (for example, writing a valid cron entry to /etc/cron.d/ achieves code execution within one scheduler cycle with no server restart required). Version 0.17.0 fixes the issue.", "creation_timestamp": "2026-08-27T15:00:07.975778Z"}]}