The sooperset mcp-atlassian module, used as a Model Context Protocol server for Atlassian products like Confluence and Jira, contains a path traversal vulnerability (CWE-22) prior to version 0.22.0. The validate_safe_path function defaults to using the current working directory as the base directory, and affected Confluence attachment call sites do not specify a base_dir parameter. This allows attacker-controlled writes within the working directory, enabling overwriting of Python modules. Such overwrites can lead to remote code execution when the application later imports the compromised modules. This vulnerability bypasses previous remediation tracked as CVE-2026-27825. The vulnerability has a CVSS 4.0 score of 8.3 (high severity) and is fixed in version 0.22.0.

An attacker can write files to arbitrary locations within the application's working directory due to improper path validation. This can lead to overwriting Python modules, resulting in remote code execution when the application imports these modules. The vulnerability allows an attacker to bypass prior mitigations and execute arbitrary code with the privileges of the affected application.

Upgrade sooperset mcp-atlassian to version 0.22.0 or later, where the vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in 0.22.0.