A high-severity path traversal vulnerability in Sooperset mcp-atlassian allows authenticated attackers to achieve remote code execution by overwriting critical system files.

The flaw exists in the validate_safe_path function, which defaults to the current working directory, allowing an authenticated attacker to perform arbitrary file writes. By overwriting specific Python modules that are subsequently imported by the application, an attacker can trigger remote code execution.

Successful exploitation of this vulnerability permits an authenticated attacker to gain code execution within the context of the application server. This level of access could lead to full system compromise, the exfiltration of sensitive Atlassian data, or lateral movement within the network. With a CVSS score of 8.3, this issue presents a significant security risk that necessitates immediate attention.

Immediate Action: Upgrade the mcp-atlassian package to version 0.22.0 or later to ensure the base directory validation is correctly implemented.

Proactive Monitoring: Monitor server logs for unusual file write operations or unexpected modifications to Python library files within the application environment.

Compensating Controls: Implement strict file system permissions to prevent the application service account from modifying critical directories or sensitive Python modules.

Public Exploit Available: Unknown.

Given the potential for remote code execution, organizations utilizing the mcp-atlassian server must prioritize this update. Administrators should verify their current deployment version and apply the patch to version 0.22.0 immediately to eliminate this critical attack vector.