The MCP Atlassian server for Atlassian products allows the attachment upload APIs in Jira and Confluence to accept arbitrary local filesystem paths. When an attacker supplies such a path, the server reads the specified bytes from the local file system and sends them back to the client. This data exposure enables the attacker to read configuration files, credentials, or other sensitive data that the MCP process can access. The flaw is a classic path traversal read, classified as CWE‑22, leading to a confidentiality breach.

Affected systems are installations of the sooperset MCP Atlassian server with a version earlier than 0.22.0. The flaw exists in the Jira and Confluence attachment upload paths that invoke the internal functions Jira_upload_attachment, Confluence_upload_attachment and the file_path handling code. Any system that hosts the MCP server and exposes the attachment upload endpoints is vulnerable; versions 0.22.0 and later contain the fix.

The CVSS score of 7.1 indicates a medium‑to‑high impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation via forged HTTP requests to the upload endpoints, which can be accessed by users with legitimate or compromised credentials. If an attacker can reach the MCP server, they can read any file readable by the server process, potentially exposing sensitive credentials or configuration. No known public exploits are documented.