CVE-2026-77258: MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()
Summary
The uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath(). Both download methods (downloadattachment at line 223, downloadcontentattachments at line 272) correctly call validatesafepath() before writing files, but the upload path at lines 35-79 skips this check entirely.
An AI agent connected via MCP (or an attacker influencing that agent through prompt injection) can read any file on the host and exfiltrate it by uploading it as a Confluence page attachment.
Vulnerable Code
File: src/mcpatlassian/confluence/attachments.py, lines 62-79
python No validatesafepath() call anywhere in this method if not os.path.isabs(filepath): filepath = os.path.abspath(filepath)
if not os.path.exists(filepath): return {"success": False, "error": f"File not found: {filepath}"}
filename = os.path.basename(filepath) attachment = self.uploadattachmentdirect( contentid, filepath, filename, comment, minoredit )
The validatesafepath function is already imported at line 9 of the same file, and used in the download methods. It was just not added to the upload path.
Proof of Concept
Tested with mcp-atlassian 0.21.1 on Python 3.11 (EC2, Amazon Linux 2023).
python import inspect from mcpatlassian.confluence.attachments import AttachmentsMixin
Confirm: no validatesafepath in upload source = inspect.getsource(AttachmentsMixin.uploadattachment) assert "validatesafepath" not in source # passes
Confirm: validatesafepath IS in downloads assert "validatesafepath" in inspect.getsource(AttachmentsMixin.downloadattachment) # passes assert "validatesafepath" in inspect.getsource(AttachmentsMixin.downloadcontentattachments) # passes
An MCP tool call like this reads /etc/passwd and uploads it to Confluence:
json {"tool": "confluenceuploadattachment", "arguments": {"contentid": "123456", "filepath": "/etc/passwd"}}
Impact
Exfiltration of any file readable by the MCP server process: SSH keys, AWS credentials, .env files, /etc/passwd, application secrets. Data leaves the local machine and lands on a remote Confluence instance accessible to other users.
Suggested Fix
Add validatesafepath(filepath) before the os.path.exists() check in uploadattachment, matching the existing pattern in the download methods. The function is already imported.
Other sources
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, uploadattachment in src/mcpatlassian/confluence/attachments.py accepts a caller-controlled filepath and opens the selected server-local file without restricting it to the workspace. A permitted Confluence MCP caller can upload the file as an attachment and disclose data readable by the server process. This issue is fixed in version 0.22.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mcp-atlassianto a version that resolves this vulnerability.Fixed in 0.22.0 - Upgrade
Upgrade
mcp-atlassianto a version that resolves this vulnerability.Fixed in 0.22.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to invoke the Confluence MCP upload_attachment capability. They do not need user interaction, but the vulnerable MCP server must be reachable to them and its process must be able to read the target file.
Are default workspace boundaries sufficient protection?
No. The affected upload_attachment implementation accepts a caller-controlled server-local file path without restricting it to the workspace, so a permitted caller can select readable files outside that boundary.
What is the immediate remediation?
Upgrade mcp-atlassian to version 0.22.0, which fixes the issue. If an upgrade cannot happen immediately, restrict access to Confluence MCP callers that can invoke upload_attachment and limit the server process's file-read permissions.
How can I determine whether an instance is affected?
Instances running a version earlier than 0.22.0 are affected. The vulnerable behavior is in src/mcp_atlassian/confluence/attachments.py, where upload_attachment opens a caller-supplied file_path without safe-path validation.