A missing directory boundary enforcement in the confluence_download_attachment tool of MCP Atlassian allows an attacker who can invoke the tool to write any data to any path on the host that the server process can reach. The attacker supplies or accesses a malicious Confluence attachment and specifies a target download_path, enabling full control over the created file content and location. This weakness leads to the ability to place executable or scheduler files such as a cron entry in /etc/cron.d/, thereby achieving code execution without requiring a server restart. The underlying defect maps to CWE-22 (Insecure Path Traversal) and CWE-73 (Insecure File Handling).

The sooperset MCP Atlassian server for Atlassian products Confluence and Jira is affected in all releases prior to version 0.17.0. Users deploying the 0.15 or 0.16 builds, for example, are vulnerable if they have not applied any later revisions. The fix is included in version 0.17.0 and subsequent releases.

The vulnerability carries a CVSS score of 9.1, indicating critical severity. The EPSS score of less than 1 % suggests a low current exploitation probability, but the potential impact remains high. The lack of listing in the CISA KEV catalog indicates no confirmed public exploits yet. Based on the description, it is inferred that any remote entity that can call the confluence_download_attachment endpoint and supply a Confluence attachment can exercise the flaw, writing arbitrary content to any writable path and thereby achieving code execution or task scheduling. This straightforward attack path, combined with the high CVSS score, makes the risk urgent for systems exposed to the MCP interface.