CVE-2026-77262
8.6 · HighArbitrary file read in MCP Atlassian through confluence_upload_attachment
MCP Atlassian opened any file_path passed to its Confluence upload tool, so a caller could read host files and push them out as attachments.
Vulnerability class
File read
Path traversal and unvalidated paths that expose local files.
1 write-up, 1 vulnerability
Vulnerabilities
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-77262 | MCP Atlassian | Path traversal in confluence_upload_attachment | 8.6 High |