9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27825

CVE-2026-27825: MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the confluence_download_attachment MCP tool accepts a download_path parameter that is written to without any directory boundary enforcement. An attacker who can call this tool and supply or access a Confluence attachment with malicious content can write arbitrary content to any path the server process has write access to. Because the attacker controls both the write destination and the written content (via an uploaded Confluence attachment), this constitutes for arbitrary code execution (for example, writing a valid cron entry to /etc/cron.d/ achieves code execution within one scheduler cycle with no server restart required). Version 0.17.0 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27825

CVE-2026-27825:

9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mcp-atlassian	pip	< 0.17.0	0.17.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handling of file downloads from Atlassian Confluence and Jira. The functions responsible for downloading attachments (download_attachment, download_content_attachments, download_issue_attachments) accepted a user-controlled path (target_path or target_dir) without proper validation. This allowed an attacker to specify a path that traverses outside of the intended download directory, such as ../../../../etc/cron.d/malicious-job. By crafting a malicious attachment and using this path traversal vulnerability, an attacker could write arbitrary files to any location on the server where the application has write permissions. This could lead to remote code execution, for example, by writing a cron job, a new SSH authorized key, or overwriting application code. The patch introduces a new utility function, validate_safe_path, which resolves the provided path and ensures it is within a safe, expected base directory. This new function is now called in all the identified vulnerable functions to prevent the path traversal.

Vulnerable functions

AttachmentsMixin.download_attachment

src/mcp_atlassian/confluence/attachments.py

The `download_attachment` function is vulnerable to path traversal. It accepts a `target_path` parameter that is used as the destination for a downloaded file. Prior to the patch, this path was not sanitized, allowing an attacker to use '..' sequences to navigate to and overwrite arbitrary files on the filesystem, leading to remote code execution. The patch introduces the `validate_safe_path` function to ensure the provided path is within the intended directory.

AttachmentsMixin.download_content_attachments

src/mcp_atlassian/confluence/attachments.py

The `download_content_attachments` function is vulnerable to path traversal. It accepts a `target_dir` parameter that specifies the directory where attachments should be saved. This path was not validated, allowing an attacker to write files to arbitrary locations on the server. The patch mitigates this by using `validate_safe_path` to confine file writes to a safe directory.

AttachmentsMixin.download_attachment

src/mcp_atlassian/jira/attachments.py

The `download_attachment` function in the Jira module also had a path traversal vulnerability. Although it had a check, it was insufficient and could be bypassed. The patch replaces the weak check with the more robust `validate_safe_path` function, which properly handles symlinks and other path traversal techniques.

AttachmentsMixin.download_issue_attachments

src/mcp_atlassian/jira/attachments.py

Similar to other attachment download functions, `download_issue_attachments` in the Jira module was vulnerable to path traversal. The existing validation was not sufficient. The patch applies the `validate_safe_path` function to ensure that the `target_dir` is a safe location, preventing malicious file writes.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.