Executive brief
Jira and Confluence attachment upload tools in the Atlassian MCP server accept file paths supplied by MCP clients and directly upload those files from the server's local filesystem. In HTTP or multi-user deployments, a malicious or compromised MCP client with upload permissions can read any file accessible to the server process—including configuration files, credentials, and secrets—and upload it to Jira or Confluence, causing disclosure of sensitive data.
Technical details
The vulnerability is an arbitrary file read and exfiltration flaw in MCP Atlassian's attachment upload tools (both Jira and Confluence). The root cause is that upload_attachment and upload_attachments methods accept caller-supplied file_path parameters, resolve them to absolute paths, and directly open and upload those files using the server process's privileges, without validating that paths are within an allowed directory. The attack vector is network-based in HTTP/SSE deployments: any MCP client with permission to invoke write/upload tools can specify an arbitrary file path (e.g., /etc/passwd, mounted secrets, configuration files) and cause the server to read and exfiltrate it. The vulnerability requires no prompt injection, user interaction, or prior network compromise; it is triggered by a normal MCP tool call. No patch information is provided in the advisory.
Affected products
- Sooperset MCP Atlassian <UNKNOWN>
Timeline
- 2026-09-22: disclosed: GHSA-f6pj-qv47-g96w published
- 2026: other: CVE-2026-77247 assigned