PYSEC-2026-4087 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

🗓️ 01 Oct 2026 16:38:36Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Incomplete path traversal in MCP Atlassian allows intra-CWD module overwrite and RCE.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-77271	22 Sep 202622:35	–	circl
CVE	CVE-2026-77271	22 Sep 202618:00	–	cve
Cvelist	CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)	22 Sep 202618:00	–	cvelist
EUVD	EUVD-2026-84629	22 Sep 202618:00	–	euvd
Github Security Blog	MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)	22 Sep 202620:36	–	github
NVD	CVE-2026-77271	22 Sep 202618:17	–	nvd
OSV	GHSA-6VMQ-24H2-PJ7J MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)	22 Sep 202620:36	–	osv
Positive Technologies	PT-2026-96931	22 Sep 202600:00	–	ptsecurity
PyPA	MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)	1 Oct 202616:38	–	pypa
Rapid7 Vulnerability Database (full)	CVE-2026-77271: Improper Limitation of a Pathname to a Restricted Directory	22 Sep 202600:00	–	rapid7

Source	Link
github	www.github.com/sooperset/mcp-atlassian/security/advisories/GHSA-6vmq-24h2-pj7j
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-77271
github	www.github.com/sooperset/mcp-atlassian/pull/1448
github	www.github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
github	www.github.com/sooperset/mcp-atlassian
github	www.github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0
pypi	www.pypi.org/project/mcp-atlassian
github	www.github.com/advisories/GHSA-6vmq-24h2-pj7j

01 Oct 2026 17:45Current

6.5Medium risk

Vulners AI Score6.5

CVSS 48.3

EPSS0.0053

MCP Atlassian path traversal module overwrite RCE validate_safe_path download_attachment