https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T15:14:25.791361+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-77253 fkie_cve-2026-77253 2026-10-01T15:14:26.463076+00:00

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

 https://vulnerability.circl.lu/vuln/ghsa-vc25-24vv-fxxm GHSA-vc25-24vv-fxxm — MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files 2026-10-01T15:14:26.463173+00:00

Affected: PyPI: mcp-atlassian

### Summary

MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MCP process and send it to Jira/Confluence as an attachment.

### Details

The Confluence MCP upload tool accepts a `file_path` described as an absolute or relative server path in `src/mcp_atlassian/servers/confluence.py:1290-1316` and forwards it directly to `confluence_fetcher.upload_attachment()` in `src/mcp_atlassian/servers/confluence.py:1356-1363`. The multi-upload variant accepts comma-separated local paths in `src/mcp_atlassian/servers/confluence.py:1372-1449`.

The Confluence attachment implementation converts relative paths to absolute paths, checks only existence, and then opens the path for upload. There is no call to `validate_safe_path()` or any allowed directory check for uploads in `src/mcp_atlassian/confluence/attachments.py:61-79`; the direct upload path opens the file with `open(file_path, "rb")` in `src/mcp_atlassian/confluence/attachments.py:467-490`.

The Jira upload implementation has the same pattern: it converts relative paths, checks existence, and opens the path in `src/mcp_atlassian/jira/attachments.py:371-388`. Jira issue update also accepts an `attachments` field as JSON or CSV local paths in `src/mcp_atlassian/servers/jira.py:1609-1662`, forwards it…