CVE-2026-77271

### Summary The path traversal fix introduced in v0.17.0 (GHSA-xjgw-4wvw-rgm4) is incomplete. `validate_safe_path()` is called without an explicit `base_dir`, defaulting to `os.getcwd()`. In standard container deployments the process CWD is the application directory (e.g. `/app`), so paths within that directory, including the application's own Python source modules, pass validation without raising an exception. An attacker can overwrite a module file and achieve remote code execution on the next process restart. Versions >= 0.17.0 are not fully patched as stated in the original advisory. Confirmed on v0.21.0 (latest). ### Details `src/mcp_atlassian/utils/io.py` — `validate_safe_path()` defaults to CWD when no `base_dir` is supplied: ```python def validate_safe_path(path, base_dir=None) -> Path: if base_dir is None: base_dir = os.getcwd() # root of the issue resolved_base = Path(base_dir).resolve(strict=False) ... if not resolved_path.is_relative_to(resolved_base): raise ValueError("Path traversal detected") ``` Both call sites in `src/mcp_atlassian/confluence/attachments.py` omit `base_dir`: ```python validate_safe_path(target_path) # line ~227, download_attachment() validate_safe_path(target_dir) # line ~270, download_content_attachments() ``` When the process CWD is `/app`, any path under `/app` satisfies `is_relative_to(CWD)` and passes the guard, including all Python source modules: ``` /app/src/mcp_atlassian/confluence/attachments.py -> passes, no exception /app/src/mcp_atlassian/servers/main.py -> passes, no exception /app/.env -> passes, no exception ``` ### PoC **Prerequisites:** same as GHSA-xjgw-4wvw-rgm4 — Confluence credentials with write access to at least one page, and network access to the MCP HTTP port. Additionally requires Python 3.10+ and `uvx` to run the proof below. The script imports `validate_safe_path` directly from the installed package