CVE-2026-27825 | sooperset mcp-atlassian up to 0.16.x Model Context Protocol /etc/cron.d/ confluence_download_attachment download_path path traversal (GHSA-xjgw-4wvw-rgm4)

A vulnerability has been found in sooperset mcp-atlassian up to 0.16.x and classified as critical. Impacted is the function confluence_download_attachment of the file /etc/cron.d/ of the component Model Context Protocol. Performing a manipulation of the argument download_path results in path traversal. This vulnerability is reported as CVE-2026-27825. The attacker must have access to the local network to execute the attack. No exploit exists. The affected component should be upgraded.