CVE-2026-77262

Summary

This flaw allows an attacker to upload arbitrary files outside the workspace by manipulating the file_path parameter in confluence_upload_attachment, potentially leading to unauthorized access to server-readable files.

Exploitability

Exploitation is moderately hard as it requires control over the file_path parameter, but preconditions such as access to the Confluence server are necessary.

Blast radius

If exploited, the impact is limited to the Confluence server, where unauthorized files could be uploaded and accessed, potentially leading to data exposure or further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to MCP Atlassian version 0.22.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.