https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 23:57:55 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-77262 <p>MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an attacker-controlled file_path and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside the workspace and upload arbitrary server-readable files to Confluence. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.</p> <p>MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an attacker-controlled file_path and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside the workspace and upload arbitrary server-readable files to Confluence. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-77262 https://vulnerability.circl.lu/vuln/ghsa-p6hp-93wp-fh6p <p><strong>Affected:</strong> PyPI: mcp-atlassian</p> <p>## Summary</p> <p>`mcp-atlassian` exposes an MCP tool `confluence_upload_attachment` whose `file_path` argument is passed directly to `open(file_path, &#34;rb&#34;)` without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart upload directed at an attacker-controlled Confluence host. In the default `streamable-http` transport the server binds `0.0.0.0` with no built-in authentication, making this remotely exploitable without credentials.</p> <p>This is the **read-side symmetric twin** of GHSA-xjgw-4wvw-rgm4 / CVE-2026-27825 (fixed in v0.17.0). The v0.17.0 patch only covered the download/write path; the upload path that reads local files was left unguarded.</p> <p>## Details</p> <p>### Vulnerable sink `src/mcp_atlassian/confluence/attachments.py:477` ```python with open(file_path, &#34;rb&#34;) as fp: files = {&#34;file&#34;: (filename, fp, content_type)} response = self.confluence.session.post(url, files=files, ...) ``` `file_path` is attacker-controlled end-to-end.</p> <p>### Taint source `src/mcp_atlassian/servers/confluence.py:1290-1369`, tool definition at `:1307`: ```python file_path: Annotated[str, Field(description=&#34;Absolute path to the file to upload&#34;)] ``` No Pydantic `pattern=`, no validator, no `validate_safe_path()` call.</p> <p>### Call chain 1. MCP client invokes `confluence_upload_attachment(page_id, file_path, ...)` 2. Server handler forwards to `ConfluenceFetcher.upload_attachment(file_path)` 3. `_upload_attachme…</p> <p><strong>Affected:</strong> PyPI: mcp-atlassian</p> <p>## Summary</p> <p>`mcp-atlassian` exposes an MCP tool `confluence_upload_attachment` whose `file_path` argument is passed directly to `open(file_path, &#34;rb&#34;)` without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart upload directed at an attacker-controlled Confluence host. In the default `streamable-http` transport the server binds `0.0.0.0` with no built-in authentication, making this remotely exploitable without credentials.</p> <p>This is the **read-side symmetric twin** of GHSA-xjgw-4wvw-rgm4 / CVE-2026-27825 (fixed in v0.17.0). The v0.17.0 patch only covered the download/write path; the upload path that reads local files was left unguarded.</p> <p>## Details</p> <p>### Vulnerable sink `src/mcp_atlassian/confluence/attachments.py:477` ```python with open(file_path, &#34;rb&#34;) as fp: files = {&#34;file&#34;: (filename, fp, content_type)} response = self.confluence.session.post(url, files=files, ...) ``` `file_path` is attacker-controlled end-to-end.</p> <p>### Taint source `src/mcp_atlassian/servers/confluence.py:1290-1369`, tool definition at `:1307`: ```python file_path: Annotated[str, Field(description=&#34;Absolute path to the file to upload&#34;)] ``` No Pydantic `pattern=`, no validator, no `validate_safe_path()` call.</p> <p>### Call chain 1. MCP client invokes `confluence_upload_attachment(page_id, file_path, ...)` 2. Server handler forwards to `ConfluenceFetcher.upload_attachment(file_path)` 3. `_upload_attachme…</p> https://vulnerability.circl.lu/vuln/ghsa-p6hp-93wp-fh6p https://vulnerability.circl.lu/vuln/pysec-2026-4099 <p><strong>Affected:</strong> PyPI: mcp-atlassian</p> <p>## Summary</p> <p>`mcp-atlassian` exposes an MCP tool `confluence_upload_attachment` whose `file_path` argument is passed directly to `open(file_path, &#34;rb&#34;)` without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart upload directed at an attacker-controlled Confluence host. In the default `streamable-http` transport the server binds `0.0.0.0` with no built-in authentication, making this remotely exploitable without credentials.</p> <p>This is the **read-side symmetric twin** of GHSA-xjgw-4wvw-rgm4 / CVE-2026-27825 (fixed in v0.17.0). The v0.17.0 patch only covered the download/write path; the upload path that reads local files was left unguarded.</p> <p>## Details</p> <p>### Vulnerable sink `src/mcp_atlassian/confluence/attachments.py:477` ```python with open(file_path, &#34;rb&#34;) as fp: files = {&#34;file&#34;: (filename, fp, content_type)} response = self.confluence.session.post(url, files=files, ...) ``` `file_path` is attacker-controlled end-to-end.</p> <p>### Taint source `src/mcp_atlassian/servers/confluence.py:1290-1369`, tool definition at `:1307`: ```python file_path: Annotated[str, Field(description=&#34;Absolute path to the file to upload&#34;)] ``` No Pydantic `pattern=`, no validator, no `validate_safe_path()` call.</p> <p>### Call chain 1. MCP client invokes `confluence_upload_attachment(page_id, file_path, ...)` 2. Server handler forwards to `ConfluenceFetcher.upload_attachment(file_path)` 3. `_upload_attachme…</p> <p><strong>Affected:</strong> PyPI: mcp-atlassian</p> <p>## Summary</p> <p>`mcp-atlassian` exposes an MCP tool `confluence_upload_attachment` whose `file_path` argument is passed directly to `open(file_path, &#34;rb&#34;)` without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart upload directed at an attacker-controlled Confluence host. In the default `streamable-http` transport the server binds `0.0.0.0` with no built-in authentication, making this remotely exploitable without credentials.</p> <p>This is the **read-side symmetric twin** of GHSA-xjgw-4wvw-rgm4 / CVE-2026-27825 (fixed in v0.17.0). The v0.17.0 patch only covered the download/write path; the upload path that reads local files was left unguarded.</p> <p>## Details</p> <p>### Vulnerable sink `src/mcp_atlassian/confluence/attachments.py:477` ```python with open(file_path, &#34;rb&#34;) as fp: files = {&#34;file&#34;: (filename, fp, content_type)} response = self.confluence.session.post(url, files=files, ...) ``` `file_path` is attacker-controlled end-to-end.</p> <p>### Taint source `src/mcp_atlassian/servers/confluence.py:1290-1369`, tool definition at `:1307`: ```python file_path: Annotated[str, Field(description=&#34;Absolute path to the file to upload&#34;)] ``` No Pydantic `pattern=`, no validator, no `validate_safe_path()` call.</p> <p>### Call chain 1. MCP client invokes `confluence_upload_attachment(page_id, file_path, ...)` 2. Server handler forwards to `ConfluenceFetcher.upload_attachment(file_path)` 3. `_upload_attachme…</p> https://vulnerability.circl.lu/vuln/pysec-2026-4099