Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled file_path values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassian issue or page, allowing an MCP caller with upload access to disclose any file readable by the server process. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, jira_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Published: 2026-09-22
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Arbitrary File Read
Action: Patch Immediately
AI Analysis

Impact

MCP Atlassian servers process caller‑controlled file paths in the attachment upload tools without enforcing server‑local path restrictions. An attacker who can upload attachments gains the ability to read any file on the server that the process can access, potentially exposing sensitive configuration, credentials, or other data. The vulnerability is an example of an arbitrary file read flaw.

Affected Systems

The issue affects the SooperSet MCP Atlassian server, versions prior to 0.22.0. The vulnerability is present in the attachment upload features of Jira and Confluence integration modules within MCP Atlassian.

Risk and Exploitability

The CVSS score is 6.5, indicating a moderate severity. An exploit requires that the attacker has permission to upload attachments to an Atlassian issue or page via the MCP server. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, suggesting limited publicly documented exploitation but a realistic possibility given user privileges. Attackers can potentially read any accessible file on the server, which could lead to confidentiality damage. Mitigation is straightforward once the upgrade path is applied.

Generated by OpenCVE AI on September 22, 2026 at 19:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade MCP Atlassian to version 0.22.0 or later to eliminate the flaw.
  • If an upgrade is not feasible, remove or restrict upload permissions for users so that only trusted accounts can use the attachment upload endpoint.
  • Apply network segmentation or firewall rules to limit external access to the MCP server, ensuring only internal trusted hosts can communicate with it.

Generated by OpenCVE AI on September 22, 2026 at 19:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Sooperset
Sooperset mcp-atlassian
Vendors & Products Sooperset
Sooperset mcp-atlassian

Tue, 22 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled file_path values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassian issue or page, allowing an MCP caller with upload access to disclose any file readable by the server process. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, jira_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Title MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Sooperset Mcp-atlassian
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-22T18:36:42.886Z

Reserved: 2026-08-20T19:14:21.330Z

Link: CVE-2026-77270

cve-icon Vulnrichment

Updated: 2026-09-22T18:36:38.461Z

cve-icon NVD

Status : Received

Published: 2026-09-22T18:17:18.947

Modified: 2026-09-22T19:16:51.067

Link: CVE-2026-77270

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T19:30:14Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')