The sooperset mcp-atlassian server contains a path traversal vulnerability that could allow an authenticated attacker to read unauthorized local files from the host system.

This is a path traversal vulnerability (CWE-22) residing in the attachment upload process. An authenticated user can supply absolute or traversal file paths to the file_path parameter, bypassing existing protections to read files outside of the intended directory.

Successful exploitation allows an attacker to exfiltrate sensitive files from the server hosting the MCP integration, potentially exposing configuration data, credentials, or other proprietary information. While the CVSS score of 6.5 reflects a Medium severity rating, the ability to read arbitrary files can lead to a complete compromise of the underlying system if sensitive environment variables or configuration files are accessed.

Immediate Action: Upgrade the sooperset mcp-atlassian package to version 0.22.0 or later immediately to apply the necessary path validation fixes.

Proactive Monitoring: Review application and system access logs for unusual file access patterns or attempts to use directory traversal sequences (such as ../) in API requests.

Compensating Controls: Ensure the service runs with the least privilege necessary, restricting its filesystem access to only the directories required for its operation to limit the scope of potential traversal.

Public Exploit Available: No (exploit_available: unknown).

This vulnerability represents a significant security risk for environments relying on the mcp-atlassian integration. Administrators should prioritize updating to version 0.22.0 across all instances to prevent unauthorized local file access. Failure to patch may allow an attacker to pivot from file disclosure to deeper system compromise.