Path traversal in sooperset mcp-atlassian
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachment` MCP tool accepts a `download_path` parameter that is written to without any directory boundary enforcement. An attacker who can call this tool and supply or access a Confluence attachment with malicious content can write arbitrary content to any path the server process has write access to. Because the attacker controls both the write destination and the written content (via an uploaded Confluence attachment), this constitutes for arbitrary code execution (for example, writing a valid cron entry to `/etc/cron.d/` achieves code execution within one scheduler cycle with no server restart required). Version 0.17.0 fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sooperset | mcp-atlassian | before 0.17.0 | 0.17.0 | Patch available | CNA |
| — | mcp-atlassian (PyPI) | before 0.17.0 | 0.17.0 | Patch available | GHSA-xjgw-4wvw-rgm4 |
- mcp-atlassian Vendorsooperset Affected before 0.17.0 Fixed in 0.17.0 Patch available CNA
- mcp-atlassian (PyPI) Vendor— Affected before 0.17.0 Fixed in 0.17.0 Patch available GHSA-xjgw-4wvw-rgm4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:* | before 0.17.0 | Vulnerable | Mcp-atlassian |
- cpe:2.3:a:mcp-atlassian:mcp_atlassian:*:*:*:*:*:*:*:* Versions before 0.17.0 Vulnerable ·Mcp-atlassian
Remediation
- Fix · CNA mcp-atlassian (sooperset) Fixed in 0.17.0
- Fix · GHSA-xjgw-4wvw-rgm4 mcp-atlassian (PyPI) Fixed in 0.17.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27825
- 2026-10-03 Alias added: GHSA-xjgw-4wvw-rgm4
- 2026-10-25 EPSS moved to the 95th–99th percentile
References
More sooperset vulnerabilities
- TI-2026-53938 MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials CVSS 3.1CRITICAL 9.1
- TI-2026-53957 MCP Atlassian: SSRF Protection Bypass CVSS 4.0HIGH 8.8
- TI-2026-53935 Protection mechanism failure in sooperset mcp-atlassian CVSS 4.0HIGH 8.3
- TI-2026-53946 Path traversal in sooperset mcp-atlassian CVSS 3.1HIGH 8.6
- TI-2026-53932 Path traversal in sooperset mcp-atlassian CVSS 3.1HIGH 8.6
- TI-2026-53928 MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass CVSS 3.1HIGH 8.8
Sources
- CVE-2026-27825 · CVE Program
- CVE-2026-27825 · NVD
- FIRST EPSS
- GHSA-xjgw-4wvw-rgm4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences