Description

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its client-supplied file_path directly to open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py through _upload_attachment_direct() without calling validate_safe_path. An authenticated MCP client can read any file accessible to the server process and exfiltrate it to Confluence as an attachment. If an AI agent can be induced to call the tool through untrusted content, the same flaw can disclose server environment variables such as CONFLUENCE_API_TOKEN and other credentials. This issue is fixed in version 0.22.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-12T22:17:16.973Z",
  "pubdate": "2026-08-12T22:17:16.973Z",
  "executiveSummary": "An arbitrary file read vulnerability exists in MCP Atlassian prior to version 0.22.0. The vulnerability stems from improper input validation within the attachment handling functionality of the Confluence module. Specifically, the function confluence_upload_attachment passes a client-supplied file_path directly to the Python open() function via _upload_attachment_direct() without performing path traversal validation through validate_safe_path.\nThe impact of this security flaw allows an authenticated adversary or an AI agent manipulated via indirect prompt injection to read arbitrary files accessible to the server process. Sensitive data such as environmental variables including CONFLUENCE_API_TOKEN, system files, and local credentials can be exfiltrated by uploading them as attachments to a Confluence instance.\nExploitation requires network access to the MCP server, valid authentication credentials for the MCP client, or the successful manipulation of an AI agent capable of invoking the vulnerable tool using untrusted input content. The risk severity is high due to the potential exposure of sensitive secrets and configuration data residing within the server environment.",
  "technicalDetails": "The vulnerability resides in the src/mcp_atlassian/confluence/attachments.py component of MCP Atlassian, specifically within the _upload_attachment_direct() function utilized by confluence_upload_attachment. The root cause of the flaw is the absence of input sanitization and path validation, specifically the omission of the validate_safe_path function prior to file system operations.\nWhen a request is processed, the client-supplied file_path parameter is passed directly into the built-in open(file_path, \"rb\") method. Because the application fails to restrict file resolution to an intended safe directory or validate against directory traversal sequences, the operating system resolves absolute paths or relative traversals provided by the caller.\nThe attack flow proceeds as follows: 1) An authenticated MCP client or a compromised AI agent crafts an invocation of the confluence_upload_attachment tool containing a malicious file_path pointing to a sensitive target on the host file system, such as /etc/passwd or a configuration file containing environment variables. 2) The MCP server processes the request and calls _upload_attachment_direct() with the unsanitized path. 3) The open() function successfully opens the target file in binary read mode. 4) The contents of the sensitive file are read into memory and uploaded to the designated Confluence instance as an attachment. 5) The attacker retrieves the attachment from Confluence, successfully exfiltrating the target file contents.\nThe affected product is MCP Atlassian in versions prior to 0.22.0. The vulnerability requires authentication or indirect execution via an AI agent interacting with the MCP server over the network. The post-exploitation impact includes the total disclosure of sensitive server files, operational credentials, and environment variables accessible to the security context of the running server process."
}