PT-2026-96945

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

PT-2026-96903

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The Jira and Confluence attachment upload tools fail to validate file paths, allowing for path traversal. An authenticated MCP client or an AI assistant manipulated via prompt injection can...