Evidence · DiggingBeagle record
mcp-atlassian advisory GHSA-cf68-pxw7-c8fr
Original mcp-atlassian security advisory for mcp atlassian attachment identifiers enabled path injection and off-origin downloads.
- Published
- Nov 8, 2026
- Source role
- primary disclosure
Evidence record
Original mcp-atlassian security advisory for mcp atlassian attachment identifiers enabled path injection and off-origin downloads.
Claim-level citations (2)
- supportsMCP Atlassian attachment identifiers enabled path injection and off-origin downloads: The GHSA-cf68-pxw7-c8fr advisory documents that path normalization and absolute download links could reroute requests to attacker-controlled origins; version 0.24.1 validates ID and origin.
Advisory: Summary and Details
- supportsMCP Atlassian attachment identifiers enabled path injection and off-origin downloads: The disclosed precondition is: An attacker controls attachment_id or upstream attachment metadata consumed by the Confluence tool.
Advisory: Affected configurations and reproduction