https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 16:53:53 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-77266 <p>MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen server-local file and exfiltrate it through Jira or Confluence. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and path traversal, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.</p> <p>MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen server-local file and exfiltrate it through Jira or Confluence. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and path traversal, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-77266 https://vulnerability.circl.lu/vuln/ghsa-mfv2-4wvm-9pgp <p><strong>Affected:</strong> PyPI: mcp-atlassian</p> <p>### Summary</p> <p>The `upload_attachment` functions in both the Jira and Confluence modules accept a user-controlled `file_path` parameter and open the specified file for reading **without calling `validate_safe_path()`**. An authenticated MCP client can supply an arbitrary path such as `/etc/passwd` or `/proc/self/environ`, causing the server process to read and transmit the file&#39;s contents to the remote Atlassian instance as an attachment.</p> <p>This is an **incomplete fix** relative to GHSA-xjgw-4wvw-rgm4: the `download_attachment` and `download_issue_attachments` paths were hardened with `validate_safe_path()`, but the upload direction was left unguarded in both the Jira and Confluence modules.</p> <p>---</p> <p>### Details</p> <p>**Affected functions:**</p> <p>| File | Function | Line | |------|----------|------| | `src/mcp_atlassian/jira/attachments.py` | `upload_attachment()` | ~372–415 | | `src/mcp_atlassian/confluence/attachments.py` | `upload_attachment()` | ~62–108 | | `src/mcp_atlassian/confluence/attachments.py` | `_upload_attachment_direct()` | ~476–477 |</p> <p>**Jira — vulnerable code path (`jira/attachments.py`):**</p> <p>```python def upload_attachment(self, issue_key: str, file_path: str) -&gt; dict: ... if not os.path.isabs(file_path): file_path = os.path.abspath(file_path) # resolves relative paths</p> <p>if not os.path.exists(file_path): # confirms file exists ...</p> <p># ⚠ validate_safe_path() is NEVER called here filename = os.path.basename(file_path) with…</p> <p><strong>Affected:</strong> PyPI: mcp-atlassian</p> <p>### Summary</p> <p>The `upload_attachment` functions in both the Jira and Confluence modules accept a user-controlled `file_path` parameter and open the specified file for reading **without calling `validate_safe_path()`**. An authenticated MCP client can supply an arbitrary path such as `/etc/passwd` or `/proc/self/environ`, causing the server process to read and transmit the file&#39;s contents to the remote Atlassian instance as an attachment.</p> <p>This is an **incomplete fix** relative to GHSA-xjgw-4wvw-rgm4: the `download_attachment` and `download_issue_attachments` paths were hardened with `validate_safe_path()`, but the upload direction was left unguarded in both the Jira and Confluence modules.</p> <p>---</p> <p>### Details</p> <p>**Affected functions:**</p> <p>| File | Function | Line | |------|----------|------| | `src/mcp_atlassian/jira/attachments.py` | `upload_attachment()` | ~372–415 | | `src/mcp_atlassian/confluence/attachments.py` | `upload_attachment()` | ~62–108 | | `src/mcp_atlassian/confluence/attachments.py` | `_upload_attachment_direct()` | ~476–477 |</p> <p>**Jira — vulnerable code path (`jira/attachments.py`):**</p> <p>```python def upload_attachment(self, issue_key: str, file_path: str) -&gt; dict: ... if not os.path.isabs(file_path): file_path = os.path.abspath(file_path) # resolves relative paths</p> <p>if not os.path.exists(file_path): # confirms file exists ...</p> <p># ⚠ validate_safe_path() is NEVER called here filename = os.path.basename(file_path) with…</p> https://vulnerability.circl.lu/vuln/ghsa-mfv2-4wvm-9pgp