romain-deperne/CVE-2026-77262

PoC

Arbitrary file read in mcp-atlassian via confluence_upload_attachment — CVE-2026-77262 / GHSA-p6hp-93wp-fh6p

view exploit source poc_in_githubauthor romain-depernepublished 2026-04-29catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-77262US	—	0.56% (46th)	Exploit	2026-09-22
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an attacker-controlled fi…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.