MCP Atlassian implements a model context protocol for Atlassian applications. The vulnerability arises because the validate_safe_path routine defaults to using the current working directory when no base_dir is supplied. Certain attachment endpoints on Confluence and Jira call this routine without specifying a base directory, permitting an attacker to write files directly into the server's working directory. If the attacker uploads a Python module with a name that matches a module the application imports later, the malicious code is executed during import, resulting in remote code execution. The flaw is a classic path traversal (CWE-22) that leads to dynamic code injection (CWE-94).

The affected product is the MCP Atlassian server (sooperset:mcp-atlassian) used by Atlassian Confluence and Jira. Versions earlier than 0.22.0 are vulnerable; the fix is included in release 0.22.0.

The CVSS base score is 8.3, indicating a high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is inferred to be via a web API or file upload endpoint that allows arbitrary filenames to be stored in the working directory. Successful exploitation would require the attacker to craft a request that causes the server to import the malicious module, after which arbitrary code runs with the privileges of the application. Because the flaw bypasses a previous remediation, rapid deployment of the patch is critical.