CVE-2026-77253

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Summary

MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MCP process and send it to Jira/Confluence as an attachment.

Details

The Confluence MCP upload tool accepts a file_path described as an absolute or relative server path in src/mcp_atlassian/servers/confluence.py:1290-1316 and forwards it directly to confluence_fetcher.upload_attachment() in src/mcp_atlassian/servers/confluence.py:1356-1363. The multi-upload variant accepts comma-separated local paths in src/mcp_atlassian/servers/confluence.py:1372-1449.

The Confluence attachment implementation converts relative paths to absolute paths, checks only existence, and then opens the path for upload. There is no call to validate_safe_path() or any allowed directory check for uploads in src/mcp_atlassian/confluence/attachments.py:61-79; the direct upload path opens the file with open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py:467-490.

The Jira upload implementation has the same pattern: it converts relative paths, checks existence, and opens the path in src/mcp_atlassian/jira/attachments.py:371-388. Jira issue update also accepts an attachments field as JSON or CSV local paths in src/mcp_atlassian/servers/jira.py:1609-1662, forwards it through update fields in src/mcp_atlassian/servers/jira.py:1668-1676, and IssuesMixin.update_issue() calls self.upload_attachments(issue_key, kwargs["attachments"]) in src/mcp_atlassian/jira/issues.py:1132-1137.

The tools are decorated with @check_write_access, so READ_ONLY_MODE=true blocks them. However, in default write-enabled deployments, the only security boundary is whether the MCP caller can invoke write tools. Combined with HTTP/multi-user exposure, this becomes a server-side arbitrary file read/exfiltration primitive to the configured Jira/Confluence instance.

PoC

The following proof uses temporary files and mocked upload sinks only. It does not contact Atlassian or modify remote data.

uv run python - <<'PY'
import json, tempfile
from pathlib import Path
from types import SimpleNamespace
from mcp_atlassian.confluence.attachments import AttachmentsMixin as ConfluenceAttachmentsMixin
from mcp_atlassian.confluence.config import ConfluenceConfig
from mcp_atlassian.jira.attachments import AttachmentsMixin as JiraAttachmentsMixin
from mcp_atlassian.jira.config import JiraConfig

class FakeResponse:
    def raise_for_status(self):
        pass
    def json(self):
        return {'results': [{'id': 'att-poc'}]}

class FakeConfluenceSession:
    def __init__(self):
        self.uploaded = None
    def put(self, url, headers=None, files=None, data=None):
        file_tuple = files['file']
        self.uploaded = {
            'url': url,
            'filename': file_tuple[0],
            'content': file_tuple[1].read().decode(),
        }
        file_tuple[1].close()
        return FakeResponse()

def confluence_probe(secret_path):
    fetcher = object.__new__(ConfluenceAttachmentsMixin)
    session = FakeConfluenceSession()
    fetcher.config = ConfluenceConfig(url='https://confluence.example.test/wiki', auth_type='pat', personal_token='token')
    fetcher.confluence = SimpleNamespace(_session=session)
    result = fetcher.upload_attachment('123456', str(secret_path))
    return {'result_success': result.get('success'), 'uploaded': session.uploaded}

class FakeJiraApi:
    def __init__(self):
        self.uploaded = None
    def add_attachment(self, issue_key, filename):
        self.uploaded = {
            'issue_key': issue_key,
            'filename': Path(filename).name,
            'content': Path(filename).read_text(),
        }
        return {'id': 'att-poc'}

def jira_probe(secret_path):
    fetcher =…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

Summary

MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MCP process and send it to Jira/Confluence as an attachment.

Details

The Confluence MCP upload tool accepts a file_path described as an absolute or relative server path in src/mcp_atlassian/servers/confluence.py:1290-1316 and forwards it directly to confluence_fetcher.upload_attachment() in src/mcp_atlassian/servers/confluence.py:1356-1363. The multi-upload variant accepts comma-separated local paths in src/mcp_atlassian/servers/confluence.py:1372-1449.

The Confluence attachment implementation converts relative paths to absolute paths, checks only existence, and then opens the path for upload. There is no call to validate_safe_path() or any allowed directory check for uploads in src/mcp_atlassian/confluence/attachments.py:61-79; the direct upload path opens the file with open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py:467-490.

The Jira upload implementation has the same pattern: it converts relative paths, checks existence, and opens the path in src/mcp_atlassian/jira/attachments.py:371-388. Jira issue update also accepts an attachments field as JSON or CSV local paths in src/mcp_atlassian/servers/jira.py:1609-1662, forwards it through update fields in src/mcp_atlassian/servers/jira.py:1668-1676, and IssuesMixin.update_issue() calls self.upload_attachments(issue_key, kwargs["attachments"]) in src/mcp_atlassian/jira/issues.py:1132-1137.

The tools are decorated with @check_write_access, so READ_ONLY_MODE=true blocks them. However, in default write-enabled deployments, the only security boundary is whether the MCP caller can invoke write tools. Combined with HTTP/multi-user exposure, this becomes a server-side arbitrary file read/exfiltration primitive to the configured Jira/Confluence instance.

PoC

The following proof uses temporary files and mocked upload sinks only. It does not contact Atlassian or modify remote data.

uv run python - <<'PY'
import json, tempfile
from pathlib import Path
from types import SimpleNamespace
from mcp_atlassian.confluence.attachments import AttachmentsMixin as ConfluenceAttachmentsMixin
from mcp_atlassian.confluence.config import ConfluenceConfig
from mcp_atlassian.jira.attachments import AttachmentsMixin as JiraAttachmentsMixin
from mcp_atlassian.jira.config import JiraConfig

class FakeResponse:
    def raise_for_status(self):
        pass
    def json(self):
        return {'results': [{'id': 'att-poc'}]}

class FakeConfluenceSession:
    def __init__(self):
        self.uploaded = None
    def put(self, url, headers=None, files=None, data=None):
        file_tuple = files['file']
        self.uploaded = {
            'url': url,
            'filename': file_tuple[0],
            'content': file_tuple[1].read().decode(),
        }
        file_tuple[1].close()
        return FakeResponse()

def confluence_probe(secret_path):
    fetcher = object.__new__(ConfluenceAttachmentsMixin)
    session = FakeConfluenceSession()
    fetcher.config = ConfluenceConfig(url='https://confluence.example.test/wiki', auth_type='pat', personal_token='token')
    fetcher.confluence = SimpleNamespace(_session=session)
    result = fetcher.upload_attachment('123456', str(secret_path))
    return {'result_success': result.get('success'), 'uploaded': session.uploaded}

class FakeJiraApi:
    def __init__(self):
        self.uploaded = None
    def add_attachment(self, issue_key, filename):
        self.uploaded = {
            'issue_key': issue_key,
            'filename': Path(filename).name,
            'content': Path(filename).read_text(),
        }
        return {'id': 'att-poc'}

def jira_probe(secret_path):
    fetcher =…

Summary

MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MCP process and send it to Jira/Confluence as an attachment.

Details

The Confluence MCP upload tool accepts a file_path described as an absolute or relative server path in src/mcp_atlassian/servers/confluence.py:1290-1316 and forwards it directly to confluence_fetcher.upload_attachment() in src/mcp_atlassian/servers/confluence.py:1356-1363. The multi-upload variant accepts comma-separated local paths in src/mcp_atlassian/servers/confluence.py:1372-1449.

The Confluence attachment implementation converts relative paths to absolute paths, checks only existence, and then opens the path for upload. There is no call to validate_safe_path() or any allowed directory check for uploads in src/mcp_atlassian/confluence/attachments.py:61-79; the direct upload path opens the file with open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py:467-490.

The Jira upload implementation has the same pattern: it converts relative paths, checks existence, and opens the path in src/mcp_atlassian/jira/attachments.py:371-388. Jira issue update also accepts an attachments field as JSON or CSV local paths in src/mcp_atlassian/servers/jira.py:1609-1662, forwards it through update fields in src/mcp_atlassian/servers/jira.py:1668-1676, and IssuesMixin.update_issue() calls self.upload_attachments(issue_key, kwargs["attachments"]) in src/mcp_atlassian/jira/issues.py:1132-1137.

The tools are decorated with @check_write_access, so READ_ONLY_MODE=true blocks them. However, in default write-enabled deployments, the only security boundary is whether the MCP caller can invoke write tools. Combined with HTTP/multi-user exposure, this becomes a server-side arbitrary file read/exfiltration primitive to the configured Jira/Confluence instance.

PoC

The following proof uses temporary files and mocked upload sinks only. It does not contact Atlassian or modify remote data.

uv run python - <<'PY'
import json, tempfile
from pathlib import Path
from types import SimpleNamespace
from mcp_atlassian.confluence.attachments import AttachmentsMixin as ConfluenceAttachmentsMixin
from mcp_atlassian.confluence.config import ConfluenceConfig
from mcp_atlassian.jira.attachments import AttachmentsMixin as JiraAttachmentsMixin
from mcp_atlassian.jira.config import JiraConfig

class FakeResponse:
    def raise_for_status(self):
        pass
    def json(self):
        return {'results': [{'id': 'att-poc'}]}

class FakeConfluenceSession:
    def __init__(self):
        self.uploaded = None
    def put(self, url, headers=None, files=None, data=None):
        file_tuple = files['file']
        self.uploaded = {
            'url': url,
            'filename': file_tuple[0],
            'content': file_tuple[1].read().decode(),
        }
        file_tuple[1].close()
        return FakeResponse()

def confluence_probe(secret_path):
    fetcher = object.__new__(ConfluenceAttachmentsMixin)
    session = FakeConfluenceSession()
    fetcher.config = ConfluenceConfig(url='https://confluence.example.test/wiki', auth_type='pat', personal_token='token')
    fetcher.confluence = SimpleNamespace(_session=session)
    result = fetcher.upload_attachment('123456', str(secret_path))
    return {'result_success': result.get('success'), 'uploaded': session.uploaded}

class FakeJiraApi:
    def __init__(self):
        self.uploaded = None
    def add_attachment(self, issue_key, filename):
        self.uploaded = {
            'issue_key': issue_key,
            'filename': Path(filename).name,
            'content': Path(filename).read_text(),
        }
        return {'id': 'att-poc'}

def jira_probe(secret_path):
    fetcher =…