GHSA-H7WJ-5V37-59R2
Vulnerability from github – Published: 2026-09-22 20:35 – Updated: 2026-09-22 20:35Summary
The confluence_upload_attachment and confluence_upload_attachments MCP tools accept a file_path parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process (SSH keys, .env files, API credentials) and exfiltrate it by uploading it to Confluence.
Note: The Jira upload_attachment mixin method in jira/attachments.py has the same missing validation, but it is NOT registered as an MCP tool in servers/jira.py and is therefore not currently reachable via MCP. It should still be patched to prevent future exposure if Jira upload tools are added.
This is an incomplete fix for CVE-2026-27825. That CVE was patched by adding validate_safe_path() to download operations (v0.17.0). The same protection was not applied to upload operations.
Details
validate_safe_path() is imported in both confluence/attachments.py and jira/attachments.py and is correctly called in all download functions. It is absent from the Confluence upload functions (which are exposed as MCP tools) and from the Jira upload mixin methods (which are not currently registered as MCP tools but should still be patched).
Download (protected — correctly patched):
# confluence/attachments.py:222-223
validate_safe_path(target_path) # resolves symlinks + checks is_relative_to(cwd)
Upload (vulnerable — not patched):
# confluence/attachments.py:64-79 — NO validate_safe_path() call
if not os.path.isabs(file_path):
file_path = os.path.abspath(file_path) # normalizes but does NOT restrict
# ...
files = {"file": (filename, open(file_path, "rb"))} # opens arbitrary file
Same pattern in jira/attachments.py:386.
Proof of Concept
# Call via MCP client
await session.call_tool("confluence_upload_attachment", {
"content_id": "12345",
"file_path": "/home/user/.ssh/id_rsa" # absolute path — no traversal needed
})
# SSH private key is now a Confluence attachment
# Retrieve via: confluence_download_attachment or Confluence UI
Impact
Arbitrary file read from the server filesystem. High-value targets: SSH private keys, .env files, AWS/GCP credentials, database configuration, source code.
Fix
Add validate_safe_path(file_path) call in confluence/attachments.py:upload_attachment() (reachable via MCP) and jira/attachments.py:upload_attachment() (not currently reachable via MCP, but should be patched preventively), consistent with the existing download protection. No changes to validate_safe_path() itself are needed.
# Add after os.path.abspath() call:
try:
validate_safe_path(file_path)
except ValueError as e:
return {"success": False, "error": str(e)}
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mcp-atlassian"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-77269"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-22T20:35:03Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nThe `confluence_upload_attachment` and `confluence_upload_attachments` MCP tools accept a `file_path` parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process (SSH keys, .env files, API credentials) and exfiltrate it by uploading it to Confluence.\n\nNote: The Jira `upload_attachment` mixin method in `jira/attachments.py` has the same missing validation, but it is NOT registered as an MCP tool in `servers/jira.py` and is therefore not currently reachable via MCP. It should still be patched to prevent future exposure if Jira upload tools are added.\n\nThis is an incomplete fix for CVE-2026-27825. That CVE was patched by adding `validate_safe_path()` to download operations (v0.17.0). The same protection was not applied to upload operations.\n\n### Details\n\n`validate_safe_path()` is imported in both `confluence/attachments.py` and `jira/attachments.py` and is correctly called in all download functions. It is absent from the Confluence upload functions (which are exposed as MCP tools) and from the Jira upload mixin methods (which are not currently registered as MCP tools but should still be patched).\n\n**Download (protected \u2014 correctly patched):**\n```python\n# confluence/attachments.py:222-223\nvalidate_safe_path(target_path) # resolves symlinks + checks is_relative_to(cwd)\n```\n\n**Upload (vulnerable \u2014 not patched):**\n```python\n# confluence/attachments.py:64-79 \u2014 NO validate_safe_path() call\nif not os.path.isabs(file_path):\n file_path = os.path.abspath(file_path) # normalizes but does NOT restrict\n# ...\nfiles = {\"file\": (filename, open(file_path, \"rb\"))} # opens arbitrary file\n```\n\nSame pattern in `jira/attachments.py:386`.\n\n### Proof of Concept\n\n```python\n# Call via MCP client\nawait session.call_tool(\"confluence_upload_attachment\", {\n \"content_id\": \"12345\",\n \"file_path\": \"/home/user/.ssh/id_rsa\" # absolute path \u2014 no traversal needed\n})\n# SSH private key is now a Confluence attachment\n# Retrieve via: confluence_download_attachment or Confluence UI\n```\n\n### Impact\n\nArbitrary file read from the server filesystem. High-value targets: SSH private keys, `.env` files, AWS/GCP credentials, database configuration, source code.\n\n### Fix\n\nAdd `validate_safe_path(file_path)` call in `confluence/attachments.py:upload_attachment()` (reachable via MCP) and `jira/attachments.py:upload_attachment()` (not currently reachable via MCP, but should be patched preventively), consistent with the existing download protection. No changes to `validate_safe_path()` itself are needed.\n\n```python\n# Add after os.path.abspath() call:\ntry:\n validate_safe_path(file_path)\nexcept ValueError as e:\n return {\"success\": False, \"error\": str(e)}\n```",
"id": "GHSA-h7wj-5v37-59r2",
"modified": "2026-09-22T20:35:03Z",
"published": "2026-09-22T20:35:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-h7wj-5v37-59r2"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
},
{
"type": "PACKAGE",
"url": "https://github.com/sooperset/mcp-atlassian"
},
{
"type": "WEB",
"url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.