CVE-2026-77266

Katalog CVE

CVSS 6.5 · Medium EPSS 0,44%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada mcp-atlassian mcp atlassian. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen server-local file and exfiltrate it through Jira or Confluence. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and path traversal, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Rincian

Terbit di NVD

22 September 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-mfv2-4wvm-9pgp exploit · advisory vendor
• https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460 patch
• https://github.com/sooperset/mcp-atlassian/pull/1448 issue tracking · patch
• https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0 release notes