GHSA-xjgw-4wvw-rgm4: MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment

Summary

GHSA-xjgw-4wvw-rgm4 affects MCP Atlassian. The confluence_download_attachment tool accepts a download_path parameter that is written to without any directory boundary enforcement, so an attacker who controls an attachment's content can write it to any path the server process can write, such as /etc/cron.d/, leading to arbitrary code execution. The MCP HTTP transport carries no authentication by default and binds to 0.0.0.0, so the issue is reachable from the local network.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online