EUVD-2026-84629

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE bypass of GHSA-xjgw-4wvw-rgm4...

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...

CVE-2026-77271

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to a module overwrite flaw prior to version 0.22.0 . The root cause is that the validate_safe_path function defaults its base directory to os.getcwd(), while certain Confluence attachment call sites omit the bas...