CVE-2026-27825 in the critical feed json
MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment
published 2026-03-10 8 mo ago modified 2026-07-01 4 mo ago also GHSA-xjgw-4wvw-rgm4 , PYSEC-2026-408 , EUVD-2026-10810
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 12.3%
- EPSS 12.3% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachment` MCP tool accepts a `download_path` parameter that is written to without any directory boundary enforcement. An attacker who can call this tool and supply or access a Confluence attachment with malicious content can write arbitrary content to any path the server process has write access to. Because the attacker controls both the write destination and the written content (via an uploaded Confluence attachment), this constitutes for arbitrary code execution (for example, writing a valid cron entry to `/etc/cron.d/` achieves code execution within one scheduler cycle with no server restart required). Version 0.17.0 fixes the issue.
Patch / fix
- pypi mcp-atlassian 0.17.0
- mcp-atlassian mcp_atlassian 0.17.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction
12.25% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| OSV | 3.1 | 9.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mcp-atlassian | <0.17.0 |
0.17.0 |
Affected products
- sooperset mcp-atlassian
Classification
References
-
github.com
/sooperset/mcp-atlassian/commit/52b9b0997681e87244b20d58034deae89c91631e
web, patch
-
github.com
/sooperset/mcp-atlassian/security/advisories/GHSA-xjgw-4wvw-rgm4
web, vendor-advisory
-
github.com
/sooperset/mcp-atlassian
package
-
pypi.org
/project/mcp-atlassian
package
-
github.com
/advisories/GHSA-xjgw-4wvw-rgm4
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-27825
advisory
Sources
- CVE List CVE-2026-27825
- GitHub Advisory GHSA-xjgw-4wvw-rgm4
- NVD CVE-2026-27825
- OSV PYSEC-2026-408
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.