Executive brief
MCP adapters for Atlassian Confluence and Jira contain path traversal vulnerabilities in file upload functions used by AI assistants to attach files to pages and issues. An authenticated attacker or AI assistant tricked via prompt injection can upload any file readable by the server process—such as SSH keys, environment credentials, or configuration files—to attacker-controlled Confluence pages or Jira issues, leading to credential theft and system compromise.
Technical details
The vulnerability is a path traversal flaw in the upload_attachment methods of both Confluence (src/mcp_atlassian/confluence/attachments.py:35–108) and Jira (src/mcp_atlassian/jira/attachments.py:353–415) MCP server implementations. The upload functions accept file_path parameters and convert relative paths to absolute paths using os.path.abspath(), but fail to call the validate_safe_path() utility function that is correctly applied to download operations. This allows arbitrary files (e.g., /etc/passwd, ~/.ssh/id_rsa, .env) to be read and uploaded. The vulnerability requires authentication (enforced by @check_write_access decorator) and network access to the MCP server, but can be amplified via prompt injection if an AI assistant processes malicious Confluence/Jira content. The recommended fix is to call validate_safe_path() before reading the file in both upload methods, as already done for download operations.
Affected products
- Atlassian MCP Confluence affected versions not specified in advisory
- Atlassian MCP Jira affected versions not specified in advisory
Timeline
- 2026-09-22: disclosed: Published as GHSA-f26r-j276-ggg4
- 2026-09-22: other: CVE-2026-77270 assigned