CVE-2026-73496: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in sooperset mcp-atlassian
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through src/mcp_atlassian/confluence/attachments.py upload_attachment, and the jira_update_issue attachments parameter reaches src/mcp_atlassian/jira/attachments.py upload_attachment, without confining either path to an approved server workspace. In a remote HTTP, SSE, or multi-user deployment, absolute or traversing paths are resolved on the MCP server and uploaded to Atlassian, allowing a client with write-tool access to disclose server files, environment-held Atlassian credentials, or another tenant's data. A local single-user stdio deployment does not cross this trust boundary because the server runs in the caller's environment. This issue is fixed in version 0.22.0.
AI Analysis
Technical Summary
The vulnerability in sooperset mcp-atlassian (before 0.22.0) involves improper limitation of pathname to a restricted directory (CWE-22). Specifically, the confluence_upload_attachment(s) and jira_update_issue tools accept client-controlled file paths that are not confined to an approved workspace. In remote HTTP, SSE, or multi-user deployments, this allows absolute or path-traversing file paths to be resolved on the MCP server, potentially exposing sensitive files and credentials. Local single-user stdio deployments are not affected due to the server running in the caller's environment. The vulnerability is fixed in version 0.22.0.
Potential Impact
An attacker with write-tool access can exploit this vulnerability to disclose sensitive server files, including environment-held Atlassian credentials and data from other tenants. This can lead to confidentiality breaches but does not affect integrity or availability. The vulnerability has a CVSS 3.1 score of 7.7 (high severity) with network attack vector, low attack complexity, required privileges, no user interaction, and scope change.
Mitigation Recommendations
Upgrade to version 0.22.0 or later, where this path traversal vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in 0.22.0.
CVE-2026-73496: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in sooperset mcp-atlassian
Description
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through src/mcp_atlassian/confluence/attachments.py upload_attachment, and the jira_update_issue attachments parameter reaches src/mcp_atlassian/jira/attachments.py upload_attachment, without confining either path to an approved server workspace. In a remote HTTP, SSE, or multi-user deployment, absolute or traversing paths are resolved on the MCP server and uploaded to Atlassian, allowing a client with write-tool access to disclose server files, environment-held Atlassian credentials, or another tenant's data. A local single-user stdio deployment does not cross this trust boundary because the server runs in the caller's environment. This issue is fixed in version 0.22.0.
CVSS v3.1
Score 7.7high
Affected software
sooperset
mcp-atlassian
pkg:github/sooperset/mcp-atlassianRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in sooperset mcp-atlassian (before 0.22.0) involves improper limitation of pathname to a restricted directory (CWE-22). Specifically, the confluence_upload_attachment(s) and jira_update_issue tools accept client-controlled file paths that are not confined to an approved workspace. In remote HTTP, SSE, or multi-user deployments, this allows absolute or path-traversing file paths to be resolved on the MCP server, potentially exposing sensitive files and credentials. Local single-user stdio deployments are not affected due to the server running in the caller's environment. The vulnerability is fixed in version 0.22.0.
Potential Impact
An attacker with write-tool access can exploit this vulnerability to disclose sensitive server files, including environment-held Atlassian credentials and data from other tenants. This can lead to confidentiality breaches but does not affect integrity or availability. The vulnerability has a CVSS 3.1 score of 7.7 (high severity) with network attack vector, low attack complexity, required privileges, no user interaction, and scope change.
Mitigation Recommendations
Upgrade to version 0.22.0 or later, where this path traversal vulnerability is fixed. No other mitigations are specified. Patch status is confirmed fixed in 0.22.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-12T19:00:33.735Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa852d655bf5e2cf589359f
Added to database: 09/14/2026, 20:02:30 UTC
Last enriched: 09/14/2026, 20:16:28 UTC
Last updated: 09/15/2026, 04:24:02 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.