CVE-2026-77259 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files,...

PT-2020-10809

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.18.0 Description The issue is related to weak permissions for server-local file storage. Recommendations For versions prior to 5.18.0, update to version 5.18.0 or later to resolve the issue...