sooperset mcp-atlassian arbitrary file read in attachment upload

Executive brief

mcp-atlassian is a tool used to integrate AI agents with Atlassian services like Jira and Confluence. A security flaw allows a remote user to trick the server into reading its own internal files and uploading them as attachments to Atlassian pages or issues. This could lead to the theft of sensitive system data, including the server's own access tokens and credentials, potentially compromising the entire Atlassian environment.

Technical details

A path traversal and arbitrary file read vulnerability exists in mcp-atlassian's attachment upload functionality. The 'file_path' parameter in tools like 'confluence_upload_attachment' and 'jira_update_issue' is passed directly to Python's open() function on the server host without validation. In remote deployments (HTTP/SSE), an attacker can provide absolute or relative paths (e.g., /etc/passwd or /proc/self/environ) to exfiltrate sensitive files from the server's filesystem by having them uploaded as attachments to Jira or Confluence. This vulnerability allows for the disclosure of environment variables, including Atlassian API tokens. The issue is fixed in version 0.22.0.

Affected products

• sooperset mcp-atlassian < 0.22.0

Timeline

• 2026-07-10: advisory: GitHub Advisory GHSA-wm45-qh3g-v83f published
• 2026-07-10: patched: Fixed in version 0.22.0

References

• https://api.github.com/users/0xmagic0
• https://github.com/0xmagic0
• https://api.github.com/users/0xmagic0/gists%7B/gist_id%7D
• https://api.github.com/users/0xmagic0/repos
• https://avatars.githubusercontent.com/u/102229946?v=4
• https://api.github.com/users/0xmagic0/events%7B/privacy%7D