Executive brief
The Atlassian MCP (Model Context Protocol) tool for uploading attachments to Confluence does not properly validate file paths, allowing an attacker to read any file on the server where the MCP process runs. An attacker could access sensitive files like SSH keys, API credentials, environment configuration files, and source code, then exfiltrate them by uploading them to Confluence as attachments. This is a critical data exposure risk for organizations using MCP-enabled Atlassian integrations.
Technical details
The vulnerability is a path traversal flaw in the `confluence_upload_attachment` and `confluence_upload_attachments` MCP tools (and the unreachable but similarly flawed Jira `upload_attachment` mixin). The vulnerable code calls `os.path.abspath()` to normalize file paths but fails to invoke the `validate_safe_path()` function that is correctly used in all corresponding download operations. This allows an attacker with access to the MCP tools to specify arbitrary absolute or relative paths (e.g., `/home/user/.ssh/id_rsa`) and read any file accessible to the MCP server process. The fix requires adding a `validate_safe_path()` call to the upload functions, consistent with the incomplete CVE-2026-27825 patch that only addressed downloads in v0.17.0. No authentication or user interaction is required beyond the ability to call the MCP tool.
Affected products
- Atlassian MCP before fix
Timeline
- 2026-09-22: disclosed: GHSA-h7wj-5v37-59r2 published
- v0.17.0: other: Incomplete fix for CVE-2026-27825: validate_safe_path() added to downloads only