Executive brief
MCP Atlassian is a tool that integrates Atlassian products (Confluence, Jira) with AI assistants. The upload_attachment feature fails to validate file paths, allowing any authenticated user with edit access to read arbitrary files from the server—including sensitive configuration files and credential stores. In cloud or containerized deployments, attackers can extract API tokens and credentials needed for persistent unauthorized access to Atlassian infrastructure.
Technical details
The vulnerability exists in `AttachmentsMixin.upload_attachment()` in src/mcp_atlassian/confluence/attachments.py (line 477), which opens a caller-supplied file path without boundary validation. While a similar download path vulnerability (GHSA-xjgw-4wvw-rgm4) was previously fixed using a `validate_safe_path()` function, the upload path was left unguarded. An authenticated MCP client with edit access to any Confluence page can exploit this to read arbitrary files. On Linux, direct access to `/proc/self/environ` exposes all runtime secrets. The fix requires applying the existing `validate_safe_path()` validation to the upload and upload_attachments functions, as well as corresponding Jira attachment handlers.
Affected products
- Atlassian MCP Atlassian 0.21.1 and earlier
Timeline
- 2026-09-22: disclosed: GHSA-6cr4-ccf3-x7h4 published
- 2026: other: CVE-2026-77259 assigned