CVE-2026-77253

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

CVE-2026-77270

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

CVE-2026-77253 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

CVE-2026-77253 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

CVE-2026-77253 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

EUVD-2026-84742

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

CVE-2026-77253

The MCP Atlassian Model Context Protocol server (versions prior to 0.22.0 ) contains a vulnerability where the Jira and Confluence attachment upload tools accept arbitrary local filesystem paths. An attacker can cross the client-to-server filesystem boundary to disclose sensitive data, such as co...

CVE-2026-77270 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

CVE-2026-77270 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

CVE-2026-77270 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

CVE-2026-77270

The MCP Atlassian server (a Model Context Protocol server for Jira and Confluence) is vulnerable in versions prior to 0.22.0 . The jira_upload_attachment and confluence_upload_attachment tools fail to validate file_path values, treating caller-controlled inputs as trusted server-local paths. An a...

EUVD-2026-84605

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

CVE-2026-77270: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

CVE-2026-77253: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...