fkie_cve-2026-77260

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Confluence and Jira upload_attachment implementations accept an unconstrained file_path and open the referenced server-local file. A permitted MCP caller can upload sensitive host files to an Atlassian destination and then retrieve their contents. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

GHSA-f4p7-qx46-wc5j — MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

Affected: PyPI: mcp-atlassian

## Summary

This is an arbitrary local file READ vulnerability on the Confluence and Jira `upload_attachment` tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open.

**Reporter:** Sean Valentine **Severity:** High (Critical in LLM-driven / prompt-injection deployments) **Affected versions:** main branch as of 2026-04-21. Both Confluence and Jira upload paths.

## Details

**File:** `src/mcp_atlassian/confluence/attachments.py` lines 62-78 and 477

```python try: if not os.path.isabs(file_path): file_path = os.path.abspath(file_path) if not os.path.exists(file_path): return {"success": False, "error": f"File not found: {file_path}"} ... attachment = self._upload_attachment_direct(content_id, file_path, filename, comment, minor_edit)

# attachments.py L477 files = {"file": (filename, open(file_path, "rb"))} ```

Same shape in `src/mcp_atlassian/jira/attachments.py` around lines 374-386.

`validate_safe_path()` was added to the download paths as the CVE-2026-27825 fix, but the symmetric upload paths were never updated. `os.path.abspath()` alone does not restrict the result to any safe base directory, so absolute paths like `/etc/shadow`, `/root/.ssh/id_rsa`, or `~/.aws/credentials` are opened and uploaded verbatim. The Jira `update_issue` tool exposes the same primitive via its `attachments` parameter.

## PoC

Two reachable paths:…

Most recent entries from all

fkie_cve-2026-77260

GHSA-f4p7-qx46-wc5j — MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)