Skip to content
Heist/ feed
Back to feed
High

MCP Atlassian: Arbitrary server-side file read via attachment upload

Type: advisorySources: OSV

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through src/mcp_atlassian/confluence/attachments.py upload_attachment, and the jira_update_issue attachments parameter reaches src/mcp_atlassian/jira/attachments.py upload_attachment, without confining either path to an approved server workspace. In a remote HTTP, SSE, or multi-user deployment, absolute or traversing paths are resolved on the MCP server and uploaded to Atlassian, allowing a client with write-tool access to disclose server files, environment-held Atlassian credentials, or another tenant's data. A local single-user stdio deployment does not cross this trust boundary because the server runs in the caller's environment. This issue is fixed in version 0.22.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-73496
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 02:48 UTC · Revision 1

Source evidence

MCP Atlassian: Arbitrary server-side file read via attachment upload

core-osv · Original source

Published 14 Sept 2026, 19:49 UTC

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through src/mcp_atlassian/confluence/attachments.py upload_attachment, and the jira_update_issue attachments parameter reaches src/mcp_atlassian/jira/attachments.py upload_attachment, without confining either path to an approved server workspace. In a remote HTTP, SSE, or multi-user deployment, absolute or traversing paths are resolved on the MCP server and uploaded to Atlassian, allowing a client with write-tool access to disclose server files, environment-held Atlassian credentials, or another tenant's data. A local single-user stdio deployment does not cross this trust boundary because the server runs in the caller's environment. This issue is fixed in version 0.22.0.

osv:CVE-2026-73496
Complete source record
{
  "id": "49684894cea11ac7ea724ad7a26b203a8efe87f8f27ba09c311f5fe74476486d",
  "url": "https://osv.dev/vulnerability/CVE-2026-73496",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "MCP Atlassian: Arbitrary server-side file read via attachment upload",
    "summary": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through src/mcp_atlassian/confluence/attachments.py upload_attachment, and the jira_update_issue attachments parameter reaches src/mcp_atlassian/jira/attachments.py upload_attachment, without confining either path to an approved server workspace. In a remote HTTP, SSE, or multi-user deployment, absolute or traversing paths are resolved on the MCP server and uploaded to Atlassian, allowing a client with write-tool access to disclose server files, environment-held Atlassian credentials, or another tenant's data. A local single-user stdio deployment does not cross this trust boundary because the server runs in the caller's environment. This issue is fixed in version 0.22.0.",
    "evidence": "osv:CVE-2026-73496",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-73496",
      "aliases": [
        "CVE-2026-73496",
        "GHSA-wm45-qh3g-v83f"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/sooperset/mcp-atlassian",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "b041733473f95119dd539542a43c280737a8e460"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.22.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b041733473f95119dd539542a43c280737a8e460"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b041733473f95119dd539542a43c280737a8e460"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v0.22.0"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.22.0"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.21.1",
            "v0.21.0",
            "v0.20.1",
            "v0.20.0",
            "v0.19.0",
            "v0.18.1",
            "v0.18.0",
            "v0.17.0",
            "v0.16.1",
            "v0.16.0",
            "v0.15.0",
            "v0.14.3",
            "v0.14.2",
            "v0.14.1",
            "v0.14.0",
            "v0.13.1",
            "v0.13.0",
            "v0.12.0",
            "v0.11.12",
            "v0.11.11",
            "v0.11.10",
            "v0.11.9",
            "v0.11.8",
            "v0.11.7",
            "v0.11.6",
            "v0.11.5",
            "v0.11.4",
            "v0.11.3",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.10.6",
            "v0.10.5",
            "v0.10.4",
            "v0.10.3",
            "v0.10.2",
            "v0.10.1",
            "v0.10.0",
            "v0.9.0",
            "v0.8.4",
            "v0.8.3",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.1",
            "v0.7.0",
            "v0.6.5",
            "v0.6.4",
            "v0.6.3",
            "v0.6.2",
            "v0.6.1",
            "v0.6.0",
            "v0.5.0",
            "v0.4.0",
            "v0.3.1",
            "v0.3.0",
            "v0.2.6",
            "v0.2.5",
            "v0.2.4",
            "v0.2.3",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.16",
            "v0.1.15",
            "v0.1.14",
            "v0.1.13",
            "v0.1.12",
            "v0.1.11",
            "v0.1.10",
            "v0.1.8",
            "v0.1.7",
            "v0.1.6",
            "v0.1.5",
            "v0.1.4"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73496.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.307534093Z",
      "provider": "osv",
      "references": [
        "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73496.json",
        "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-wm45-qh3g-v83f",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-73496",
        "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460",
        "https://github.com/sooperset/mcp-atlassian/pull/1448"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22",
          "CWE-73"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73496.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-73496",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492000,
  "published_at": "2026-09-14T19:49:03.525+00:00"
}