https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T16:54:01.752136+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-77266 fkie_cve-2026-77266 2026-10-01T16:54:01.756049+00:00

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen server-local file and exfiltrate it through Jira or Confluence. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and path traversal, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

 https://vulnerability.circl.lu/vuln/ghsa-mfv2-4wvm-9pgp GHSA-mfv2-4wvm-9pgp — MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call 2026-10-01T16:54:01.756271+00:00

Affected: PyPI: mcp-atlassian

### Summary

The `upload_attachment` functions in both the Jira and Confluence modules accept a user-controlled `file_path` parameter and open the specified file for reading **without calling `validate_safe_path()`**. An authenticated MCP client can supply an arbitrary path such as `/etc/passwd` or `/proc/self/environ`, causing the server process to read and transmit the file's contents to the remote Atlassian instance as an attachment.

This is an **incomplete fix** relative to GHSA-xjgw-4wvw-rgm4: the `download_attachment` and `download_issue_attachments` paths were hardened with `validate_safe_path()`, but the upload direction was left unguarded in both the Jira and Confluence modules.

---

### Details

**Affected functions:**

| File | Function | Line | |------|----------|------| | `src/mcp_atlassian/jira/attachments.py` | `upload_attachment()` | ~372–415 | | `src/mcp_atlassian/confluence/attachments.py` | `upload_attachment()` | ~62–108 | | `src/mcp_atlassian/confluence/attachments.py` | `_upload_attachment_direct()` | ~476–477 |

**Jira — vulnerable code path (`jira/attachments.py`):**

```python def upload_attachment(self, issue_key: str, file_path: str) -> dict: ... if not os.path.isabs(file_path): file_path = os.path.abspath(file_path) # resolves relative paths

if not os.path.exists(file_path): # confirms file exists ...

# ⚠ validate_safe_path() is NEVER called here filename = os.path.basename(file_path) with…