{"data":{"id":"b24043ba-3b82-45de-aada-8a8923f21112","title":"GHSA-f6pj-qv47-g96w: MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters","summary":"The Jira and Confluence attachment upload tools in MCP Atlassian accept caller-controlled file_path parameters and read those paths from the MCP server's local filesystem before uploading them as Atlassian attachments. In local stdio deployments this exposes files readable by the user's MCP process, while in HTTP/SSE or streamable-http deployments any MCP client permitted to invoke upload tools can make the server read a server-local file and upload it to Jira or Confluence. The flaw is deterministic and does not depend on prompt injection or model behavior.","solution":"Server-local file uploads should be denied by default in HTTP/SSE or multi-user deployments, or uploads should be constrained to an explicit allowlisted upload directory after realpath resolution, and dangerous path forms such as remote UNC paths and file:// URLs should be rejected before filesystem checks.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-f6pj-qv47-g96w","publishedAt":"2026-09-22T20:36:29.000Z","cveId":"CVE-2026-77247","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mcp-atlassian@< 0.22.0 (fixed: 0.22.0)"],"affectedPackageNames":["mcp-atlassian"],"affectedPackageRefs":["pypi:mcp-atlassian"],"affectedVendors":[],"affectedVendorsRaw":["MCP Atlassian","mcp-atlassian","Jira","Confluence"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00388,"epssCheckedAt":"2026-11-10T00:11:22.478Z","kevDateAdded":null,"advisoryAliases":["GHSA-f6pj-qv47-g96w"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-22T20:36:29.000Z","fixReleasedAt":"2026-07-10T13:40:13.653Z","daysToFix":-74,"fixCheckedAt":"2026-10-29T21:30:18.091Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mcp-atlassian","fixedVersion":"0.22.0","matchedVersion":"0.22.0","fixReleasedAt":"2026-07-10T13:40:13.653Z","daysToFix":-74,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:17.944Z"}]}}