https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T11:11:54.932803+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-77260 fkie_cve-2026-77260 2026-09-30T11:11:55.821058+00:00

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Confluence and Jira upload_attachment implementations accept an unconstrained file_path and open the referenced server-local file. A permitted MCP caller can upload sensitive host files to an Atlassian destination and then retrieve their contents. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

 https://vulnerability.circl.lu/vuln/ghsa-f4p7-qx46-wc5j GHSA-f4p7-qx46-wc5j — MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira) 2026-09-30T11:11:55.821194+00:00

Affected: PyPI: mcp-atlassian

## Summary

This is an arbitrary local file READ vulnerability on the Confluence and Jira `upload_attachment` tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open.

**Reporter:** Sean Valentine **Severity:** High (Critical in LLM-driven / prompt-injection deployments) **Affected versions:** main branch as of 2026-04-21. Both Confluence and Jira upload paths.

## Details

**File:** `src/mcp_atlassian/confluence/attachments.py` lines 62-78 and 477

```python try: if not os.path.isabs(file_path): file_path = os.path.abspath(file_path) if not os.path.exists(file_path): return {"success": False, "error": f"File not found: {file_path}"} ... attachment = self._upload_attachment_direct(content_id, file_path, filename, comment, minor_edit)

# attachments.py L477 files = {"file": (filename, open(file_path, "rb"))} ```

Same shape in `src/mcp_atlassian/jira/attachments.py` around lines 374-386.

`validate_safe_path()` was added to the download paths as the CVE-2026-27825 fix, but the symmetric upload paths were never updated. `os.path.abspath()` alone does not restrict the result to any safe base directory, so absolute paths like `/etc/shadow`, `/root/.ssh/id_rsa`, or `~/.aws/credentials` are opened and uploaded verbatim. The Jira `update_issue` tool exposes the same primitive via its `attachments` parameter.

## PoC

Two reachable paths:…