Loading vulnerability…
CVE-2026-27825 affects MCP Atlassian, a Model Context Protocol server for Atlassian products including Confluence and Jira. In versions prior to 0.17.0, the confluence_download_attachment tool accepts a user-controlled download_path parameter and writes attachment data to that path without enforcing directory boundaries. If an attacker can invoke the tool and can supply or access a Confluence attachment containing attacker-controlled content, they can cause the server to write arbitrary content to any filesystem location writable by the MCP Atlassian process. Because the attacker controls both the destination path and the file contents, the issue is not limited to path traversal or arbitrary file overwrite; it can be leveraged for arbitrary code execution by planting executable or interpreted content in locations that will be executed by the operating system or user environment, such as cron directories or shell startup files. The issue was fixed in MCP Atlassian version 0.17.0.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
/etc/cron.d/ for execution within one scheduler cycle, and writing to ~/.bashrc or ~/Library/LaunchAgents/ to obtain code execution on the next shell invocation or launch event.If you can’t patch tonight, do this now.
confluence_download_attachment tool, especially for untrusted users or agents. Run the MCP Atlassian service under a low-privilege account with no write access to sensitive paths such as /etc/cron.d/, shell initialization files, LaunchAgents, systemd unit paths, or application startup directories. Constrain the process with filesystem sandboxing, containerization, MAC controls, or chroot-style isolation where feasible, and limit exposure of the MCP server to trusted clients and networks only. Monitor for unexpected writes to persistence and execution paths and for anomalous attachment download activity.Patch, then assume compromise.
confluence_download_attachment tool enforces strict path validation and confines writes to an intended attachment download directory. Review the service account permissions and reduce filesystem write access to the minimum necessary so that even if similar flaws recur, sensitive paths such as scheduler directories, startup locations, and configuration directories are not writable. Inspect systems running vulnerable versions for unauthorized files or modifications in writable execution-triggering paths.1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository is a compact operational PoC for CVE-2026-27825, a path traversal / arbitrary file read issue in sooperset/mcp-atlassian's confluence_upload_attachment tool. The exploit chain is straightforward: mcp_client.py launches a real mcp-atlassian server over stdio using the Python MCP client library, sets environment variables to enable only confluence_upload_attachment, points CONFLUENCE_URL at a controlled endpoint, and invokes the tool with an attacker-chosen file_path such as /etc/passwd. Because the vulnerable server allegedly passes file_path directly to open(file_path, "rb") without validation, the chosen local file is read and then uploaded as multipart form data to the configured Confluence endpoint. mock_confluence.py is a minimal HTTP server that emulates enough of the Confluence API for the PoC to work. It responds to startup probes such as /rest/api/user/current and captures POST/PUT upload bodies, writing them to /tmp/captured_body.bin (or CAPTURE_PATH) and checking for leaked /etc/passwd markers. poc_run1.sh automates the full reproduction: starts the mock server, runs the client against the vulnerable binary in /tmp/mcp-atlassian-venv, then inspects the captured multipart body for proof of exfiltration. The repository contains 4 files total: 2 Python scripts implementing the exploit harness and mock target, 1 Bash wrapper script for reproducible execution, and 1 README documenting the vulnerability, affected source locations, impact, and reproduction steps. This is not merely a detector; it is an end-to-end exploit demonstration showing arbitrary file read and HTTP exfiltration. The main fingerprintable targets are local sensitive files like /etc/passwd, the Confluence-style REST paths used by the mock server, and the default exposure claim that the vulnerable service binds 0.0.0.0 without authentication.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A path traversal vulnerability in the mcp-atlassian confluence_download_attachment tool that can be chained with CVE-2026-27826 to write executable code to startup locations and achieve unauthenticated remote code execution.
A specific vulnerability referenced in repository commit and template update messages, but no technical details are provided in the content.
A specific vulnerability referenced in template creation/correction commits, but no technical details are provided in the content.
One of two vulnerabilities in the Atlassian MCP server that can be chained to achieve unauthenticated remote code execution from the local network.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.