CVE-2026-77247: MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters
The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server’s local filesystem before uploading the file as an Atlassian attachment.
In local stdio deployments, this can expose files readable by the user’s MCP process. In documented HTTP/SSE or streamable-http deployments, the impact is higher: any MCP client that is allowed to invoke write/upload tools can cause the server process to read a server-local file and upload it to Jira or Confluence.
This is not dependent on an AI prompt injection or model behavior. It can be triggered deterministically with a normal MCP tool call.
References
- github.com/advisories/GHSA-f6pj-qv47-g96w
- github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460
- github.com/sooperset/mcp-atlassian/pull/1448
- github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0
- github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w
- nvd.nist.gov/vuln/detail/CVE-2026-77247
Code Behaviors & Features
Detect and mitigate CVE-2026-77247 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →