CVE-2026-124503

The Atlassian MCP upload boundary could include unrelated local files

mcp-atlassian maintainers · mcp-atlassian attachment upload tools

First documented disclosure · Review checkpoint

Summary

A remote MCP caller could cause an attachment integration to read files outside the operator’s intended upload folder.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The path check treated the server process’s working directory as the upload boundary. A broad working directory widened the allowed set.

Conditions required

The authenticated caller can invoke an upload tool on a remote HTTP or SSE deployment started in an overly broad directory. The service account must be able to read the selected file.

Potential impact

Local file contents could be transferred to an Atlassian destination available to the caller and integration.

Affected versions and configurations

Before 0.24.1.

Fix and mitigation status

0.24.1.

Practical next steps

Upgrade to 0.24.1. Give the service a dedicated working and upload directory, with narrowly scoped filesystem permissions.

Operating lesson

Use an operator-defined upload boundary independent of the process launch directory.

Evidence and limits

The maintainer rates CVSS 3.1 at 7.7, while VulDB assigns CVSS 4.0 at 5.3. The upstream disclosure identifies an authenticated caller and deployment-specific conditions.

Sources