---
id: "CVE-2026-124503"
page: "https://infrastack.ai/live/CVE-2026-124503"
kind: "vulnerability"
aliases: ["CVE-2026-124503"]
title: "mcp-atlassian: path traversal in file validation lets requests reach outside intended folders"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "atlassian", "mcp", "python"]
not_affected_if: ["no-file-path-tools", "version-0.24.1-or-later"]
published_at: "2026-11-10T10:16:43+00:00"
first_seen_at: "2026-11-10T10:21:12+00:00"
updated_at: "2026-11-10T10:21:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124503", "first_seen_at": "2026-11-10T10:21:12+00:00"}]
exploit_sources: []
---

# mcp-atlassian: path traversal in file validation lets requests reach outside intended folders

Link for people: https://infrastack.ai/live/CVE-2026-124503 (this .md is for agents)

The mcp-atlassian MCP server fails to properly validate file paths in validate_safe_path, allowing a crafted path argument to traverse directories. An attacker who can send requests to the server may read or write files outside the intended location.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of mcp-atlassian with `pip show mcp-atlassian` and compare it to `0.24.0`
- Look for `validate_safe_path` in `src/mcp_atlassian/utils/io.py` to confirm the affected code is present

## Fix

- mcp-atlassian: upgrade to `0.24.1`

## Timeline

- 2026-11-10T10:21:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124503

## Documents

- [advisory] Vendor advisory: github.com https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-qh7q-jmc7-rc7j
- [fix] Release notes: github.com https://github.com/sooperset/mcp-atlassian/releases/tag/v0.24.1

## From the sources

A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/mcp_atlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.24.1 is capable of addressing this issue. Upgrading the affected component is recommended. This CVE was requested by the vendor.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_