{"id":8903,"date":"2026-11-13T19:29:15","date_gmt":"2026-11-13T19:29:15","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian"},"modified":"2026-11-13T19:29:15","modified_gmt":"2026-11-13T19:29:15","slug":"cve-2026-124503-path-traversal-mcp-atlassian","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-124503-path-traversal-mcp-atlassian","title":{"rendered":"CVE-2026-124503: Path traversal in mcp-atlassian up to 0.24.0"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A path traversal vulnerability in the sooperset mcp-atlassian Model Context Protocol (MCP) server allowed authenticated remote attackers to read arbitrary files from the host system. The flaw affected versions up to 0.24.0 and was fixed in version 0.24.1 released on November 8, 2026.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> Path traversal in <code>validate_safe_path<\/code> function in <code>src\/mcp_atlassian\/utils\/io.py<\/code> allows arbitrary file read<\/li><li><strong>Who is affected:<\/strong> Remote HTTP\/SSE deployments of mcp-atlassian up to 0.24.0 started from a wide working directory (systemd default root or user home)<\/li><li><strong>CVSS:<\/strong> 4.3 (Medium)<\/li><li><strong>Fixed in:<\/strong> Version 0.24.1<\/li><li><strong>What to do:<\/strong> Upgrade to mcp-atlassian 0.24.1 or later<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The mcp-atlassian tool helps AI assistants talk to Atlassian products like Jira and Confluence. A security flaw let someone who could connect to a remote mcp-atlassian server read any file the server could see, including passwords and secret keys. The problem only affected servers running over the network (HTTP or SSE mode), not local desktop setups. If you run mcp-atlassian on a server, update to version 0.24.1. If you only use it on your own computer with Claude Desktop or Cursor, you do not need to do anything.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability resided in the <code>validate_safe_path<\/code> function in <code>src\/mcp_atlassian\/utils\/io.py<\/code>. This function was meant to confine file paths to the server&#8217;s working directory, preventing attackers from reading files outside that boundary. However, when the server process started from a wide working directory such as <code>\/<\/code> (the systemd default for system units) or the user&#8217;s home directory (the default for systemd user units), the guard became ineffective.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An authenticated remote MCP caller could invoke the <code>confluence_upload_attachment<\/code> or <code>jira_upload_attachment<\/code> tools with a <code>file_path<\/code> parameter pointing to any file readable by the server process, such as <code>\/etc\/passwd<\/code>, <code>\/proc\/self\/environ<\/code> (containing Atlassian API tokens), <code>.env<\/code> files, or SSH keys. The server would read the file and upload it to the caller&#8217;s own Confluence or Jira instance, effectively exfiltrating the data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The project&#8217;s official documentation for remote deployment told operators to run <code>uvx mcp-atlassian --transport streamable-http<\/code> with no working-directory requirement, and nothing in the package changed or validated the working directory at startup. The vulnerability was publicly disclosed in GitHub Security Advisory GHSA-qh7q-jmc7-rc7j and assigned CVE-2026-124503.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The flaw was part of a coordinated security audit that resulted in multiple advisories consolidated by root cause. The fix landed in pull request #1448, which introduced a dedicated file directory (<code>MCP_ATLASSIAN_FILES_DIR<\/code> or <code>~\/.mcp-atlassian\/files<\/code>) for HTTP and SSE transports, replacing the implicit reliance on the process working directory.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade to mcp-atlassian version 0.24.1 or later. The fixed version is available via <code>uvx mcp-atlassian<\/code> or <code>pip install mcp-atlassian==0.24.1<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After upgrading, note that on HTTP and SSE transports, tools that read or write server files now use the directory specified by the <code>MCP_ATLASSIAN_FILES_DIR<\/code> environment variable, or <code>~\/.mcp-atlassian\/files<\/code> if unset. The server will refuse to start if that directory is <code>\/<\/code> or your home directory. The stdio transport (local desktop use) is unchanged.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you run mcp-atlassian in a systemd unit, Docker container, or shell launch for remote access, verify that your deployment uses version 0.24.1. The official Docker image was already protected because it set <code>WORKDIR \/app<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This vulnerability highlights the risk of implicit security boundaries in agent frameworks. The <code>validate_safe_path<\/code> function performed correct symlink resolution and <code>..\/<\/code> rejection, but its boundary (the process working directory) was an environment property never explicitly chosen by operators. The same root cause had already been identified on the download side in CVE-2026-77271 (GHSA-6vmq-24h2-pj7j), whose suggested fix was to pass a dedicated, explicitly configured directory instead of relying on the current working directory.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The affected population was non-containerized remote deployments: systemd units without an explicit <code>WorkingDirectory=<\/code> directive, and shell or <code>uvx<\/code> launches from a wide directory. Local stdio deployments (Claude Desktop, Cursor) were not vulnerable because the project states that local file reads are intended behavior in that context.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The fix in version 0.24.1 introduced an explicit file directory for remote transports, removed the working-directory dependency, and added startup validation to reject unsafe directory choices. The release also fixed multiple related issues in the same security audit, including HTTP transport authentication bypass, SSRF hardening, project and space filter enforcement, and OAuth token file permissions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-124503\" target=\"_blank\" rel=\"noreferrer noopener\">NVD CVE-2026-124503<\/a><\/li><li><a href=\"https:\/\/github.com\/sooperset\/mcp-atlassian\/security\/advisories\/GHSA-qh7q-jmc7-rc7j\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Security Advisory GHSA-qh7q-jmc7-rc7j<\/a><\/li><li><a href=\"https:\/\/github.com\/sooperset\/mcp-atlassian\/pull\/1448\" target=\"_blank\" rel=\"noreferrer noopener\">Pull Request #1448: Security hardening<\/a><\/li><li><a href=\"https:\/\/github.com\/sooperset\/mcp-atlassian\/releases\/tag\/v0.24.1\" target=\"_blank\" rel=\"noreferrer noopener\">Release v0.24.1<\/a><\/li><li><a href=\"https:\/\/github.com\/sooperset\/mcp-atlassian\/\" target=\"_blank\" rel=\"noreferrer noopener\">sooperset\/mcp-atlassian repository<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A path traversal vulnerability in the sooperset mcp-atlassian MCP server up to version 0.24.0 allows authenticated remote attackers to read arbitrary files from the host system when the server runs from a wide working directory.<\/p>\n","protected":false},"author":2,"featured_media":8902,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"mcp-atlassian up to 0.24.0 in remote HTTP\/SSE deployments","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: Path traversal in MCP server exposes host files","_nx_sec_type":"mcp","_nx_sec_vendor":"sooperset","_nx_sec_fixed":"0.24.1","_nx_sec_action":""},"categories":[14,65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8903","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-124503: Path traversal in mcp-atlassian 0.24.0<\/title>\n<meta name=\"description\" content=\"CVE-2026-124503 allows remote path traversal in mcp-atlassian up to 0.24.0 via validate_safe_path. Upgrade to 0.24.1 to fix arbitrary file read.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-124503: Path traversal in mcp-atlassian 0.24.0\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-124503 allows remote path traversal in mcp-atlassian up to 0.24.0 via validate_safe_path. Upgrade to 0.24.1 to fix arbitrary file read.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T19:29:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-124503-path-traversal-mcp-atlassian-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-124503: Path traversal in mcp-atlassian up to 0.24.0\",\"datePublished\":\"2026-11-13T19:29:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian\"},\"wordCount\":691,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-124503-path-traversal-mcp-atlassian-title.webp\",\"articleSection\":[\"Agents\",\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-13T19:29:15+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian\",\"name\":\"CVE-2026-124503: Path traversal in mcp-atlassian 0.24.0\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-124503-path-traversal-mcp-atlassian-title.webp\",\"datePublished\":\"2026-11-13T19:29:15+00:00\",\"description\":\"CVE-2026-124503 allows remote path traversal in mcp-atlassian up to 0.24.0 via validate_safe_path. Upgrade to 0.24.1 to fix arbitrary file read.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-124503-path-traversal-mcp-atlassian-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-124503-path-traversal-mcp-atlassian-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-124503-path-traversal-mcp-atlassian#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-124503: Path traversal in mcp-atlassian up to 0.24.0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-124503: Path traversal in mcp-atlassian 0.24.0","description":"CVE-2026-124503 allows remote path traversal in mcp-atlassian up to 0.24.0 via validate_safe_path. Upgrade to 0.24.1 to fix arbitrary file read.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-124503: Path traversal in mcp-atlassian 0.24.0","og_description":"CVE-2026-124503 allows remote path traversal in mcp-atlassian up to 0.24.0 via validate_safe_path. Upgrade to 0.24.1 to fix arbitrary file read.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian","og_site_name":"i10X News","article_published_time":"2026-11-13T19:29:15+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-124503-path-traversal-mcp-atlassian-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-124503: Path traversal in mcp-atlassian up to 0.24.0","datePublished":"2026-11-13T19:29:15+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian"},"wordCount":691,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-124503-path-traversal-mcp-atlassian-title.webp","articleSection":["Agents","AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-13T19:29:15+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian","name":"CVE-2026-124503: Path traversal in mcp-atlassian 0.24.0","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-124503-path-traversal-mcp-atlassian-title.webp","datePublished":"2026-11-13T19:29:15+00:00","description":"CVE-2026-124503 allows remote path traversal in mcp-atlassian up to 0.24.0 via validate_safe_path. Upgrade to 0.24.1 to fix arbitrary file read.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-124503-path-traversal-mcp-atlassian-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-124503-path-traversal-mcp-atlassian-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-124503-path-traversal-mcp-atlassian#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-124503: Path traversal in mcp-atlassian up to 0.24.0"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8903","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8903"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8903\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8902"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8903"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8903"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8903"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8903"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8903"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}