What is CVE-2026-73498?
CVE-2026-73498 is a path traversal vulnerability in the MCP Atlassian server for Confluence. The `confluence_upload_attachment` function passes a user-supplied `file_path` directly to `open()`, allowing arbitrary file reads. Upgrade to version 0.22.0 to fix the issue.
Azərbaycanca: CVE-2026-73498, MCP Atlassian serverinin Confluence üçün fayl yükləmə funksiyasında path traversal zəifliyidir. İstismarçı `file_path` parametri vasitəsilə serverdən ixtiyari faylları oxuya bilər. 0.22.0 versiyasına yeniləmə tətbiq edilməlidir.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
Which parameter is targeted to exploit CVE-2026-73498?
CVE-2026-73498 is exploited through the `file_path` parameter that is passed directly to `open()` in the `confluence_upload_attachment` function of the MCP Atlassian server for Confluence.
What version should be upgraded to in order to fix CVE-2026-73498?
To fix the CVE-2026-73498 path traversal vulnerability, the MCP Atlassian server must be upgraded to version 0.22.0.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.