Description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through src/mcp_atlassian/confluence/attachments.py upload_attachment, and the jira_update_issue attachments parameter reaches src/mcp_atlassian/jira/attachments.py upload_attachment, without confining either path to an approved server workspace. In a remote HTTP, SSE, or multi-user deployment, absolute or traversing paths are resolved on the MCP server and uploaded to Atlassian, allowing a client with write-tool access to disclose server files, environment-held Atlassian credentials, or another tenant's data. A local single-user stdio deployment does not cross this trust boundary because the server runs in the caller's environment. This issue is fixed in version 0.22.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-14T20:16:50.833Z",
  "pubdate": "2026-09-14T20:16:50.833Z",
  "executiveSummary": "MCP Atlassian versions prior to 0.22.0 are susceptible to an arbitrary file disclosure vulnerability stemming from insufficient input validation in attachment handling functions. The vulnerability manifests when the server processes client-supplied file paths without enforcing workspace constraints, allowing unauthorized access to files within the server's environment.\nThe vulnerability is categorized as a path traversal flaw, enabling attackers with write-tool access to extract sensitive information, including Atlassian credentials held in the environment or data belonging to other tenants. This risk is primarily significant in remote deployment scenarios, such as HTTP, SSE, or multi-user environments where the MCP server operates in a multi-tenant or shared context.\nWhile local single-user stdio deployments are inherently protected by the existing trust boundary of the user's execution environment, remote deployments expose the server to unauthorized file retrieval. Remediation requires upgrading to version 0.22.0 or later, which introduces necessary input sanitization and path confinement logic to prevent unauthorized file system traversal.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of the 'file_path' parameter within the 'confluence_upload_attachment' and 'confluence_upload_attachments' tools located in 'src/mcp_atlassian/confluence/attachments.py', and the 'attachments' parameter in 'jira_update_issue' located in 'src/mcp_atlassian/jira/attachments.py'.\nIn affected versions, these functions accept client-controlled file paths and pass them directly to the underlying file system operations without validating or constraining the path to a designated 'approved server workspace'. Consequently, the server resolves absolute paths or directory traversal sequences (e.g., '../') provided by the client, allowing the server process to read files outside its intended operational scope.\nThe attack flow involves an authenticated client with access to the specified MCP tools crafting a malicious request containing a sensitive file path, such as '/etc/passwd' or environment variables containing API tokens/credentials used for Atlassian authentication. When the MCP server processes this request, it treats the path as a valid file to be uploaded to the target Atlassian instance.\nUpon successful resolution of the malicious path, the server reads the contents of the target file and transmits the data to the configured Atlassian service (Confluence or Jira). The attacker then retrieves this data from the Atlassian instance, effectively achieving exfiltration of server-side files.\nThis vulnerability is particularly severe in remote deployment architectures, including HTTP and SSE, where the separation between the client and the MCP server creates a trust boundary that is breached by the lack of path sanitization. In these scenarios, the server executes with the permissions of the host environment, meaning any file accessible to the server process can be exfiltrated. The impact includes, but is not limited to, the exposure of Atlassian session tokens, infrastructure secrets, and potentially cross-tenant data if the server is used in a shared-host configuration."
}