CVE-2026-27825: mcp-atlassian Arbitrary File Write Leading to Code Execution
Summary
CVE-2026-27825: The confluence_download_attachment MCP tool accepts a download_path parameter that is written to without any directory boundary enforcement. Affects mcp-atlassian versions < 0.17.0. Fixed in 0.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mcp-atlassian package is a tool designed for managing interactions with Atlassian products, particularly Confluence. It allows users to perform various operations, including downloading attachments. However, the package has a critical vulnerability that allows an attacker to write arbitrary files to the server, potentially leading to code execution. This vulnerability arises from a lack of directory boundary enforcement in the download_path parameter.
Vulnerability Detail
The vulnerability in mcp-atlassian is due to the confluence_download_attachment tool accepting a download_path parameter that is not properly validated. An attacker can exploit this by uploading a malicious attachment to Confluence and then using the tool to write this content to any writable path on the server. This can lead to arbitrary code execution, as the attacker controls both the content and the destination of the file. For example, writing a cron job entry to /etc/cron.d/ can allow the attacker to execute arbitrary commands without needing server restart.
How To Fix
Latest published version: 0.23.1 as of 23 Oct 2026
pip install --upgrade "mcp-atlassian==0.23.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.17.0
This is the first release that contains the fix.
pip install --upgrade "mcp-atlassian==0.17.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the MCP HTTP transport endpoints to trusted networks only. This can help mitigate the risk of unauthorized access to the tool until the package is updated.
Conclusion
The mcp-atlassian package has a critical vulnerability that allows arbitrary file writes, leading to potential code execution. It is essential to update to the patched version 0.17.0 to mitigate this risk. Users should also consider implementing temporary workarounds to limit exposure until they can apply the update.
See every vulnerability recorded for mcp-atlassian →
FAQ
CVE-2026-27825 is a critical vulnerability in the mcp-atlassian package that allows arbitrary file writes and potential code execution.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors for open-source vulnerabilities.
An attacker can gain arbitrary code execution on the server, potentially leading to data breaches or system compromise.
Yes, a patch is available in version 0.17.0 of the mcp-atlassian package. Updating to this version will resolve the issue.
If immediate updates are not possible, restrict access to the MCP HTTP transport endpoints and monitor for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for mcp-atlassian.
