CVE-2026-77259: MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
Summary
Missing path validation in confluenceuploadattachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call.
--- Details
AttachmentsMixin.uploadattachment() in src/mcpatlassian/confluence/attachments.py opens the caller-supplied filepath with no boundary check:
python line 477 files = {"file": (filename, open(filepath, "rb"))} The download path was correctly hardened in GHSA-xjgw-4wvw-rgm4 via validatesafepath() (lines 223, 272). That fix was not applied to the upload path, leaving it completely unguarded. The MCP tool layer (servers/confluence.py:1295) passes filepath verbatim with no additional sanitization.
--- PoC
bash 1. Prepare target file (macOS demo; on Linux use /proc/self/environ directly) cp ~/.aws/credentials /tmp/diagram.png
2. Call the MCP tool confluenceuploadattachment( contentid = "<any page attacker can edit>", filepath = "/tmp/diagram.png" )
3. Download attachment from Confluence — contains raw credentials Tested on mcp-atlassian 0.21.1 against live Confluence Cloud. Attachment confirmed uploaded and retrieved with full credential content intact.
--- Impact Any MCP client with edit access to one Confluence page can read arbitrary files from the server process. On shared/Docker deployments, /proc/self/environ exposes all users' API tokens in a single request. Exfiltrated Atlassian tokens provide persistent API access independent of MCP, surviving server shutdown or patching.
Incomplete fix of GHSA-xjgw-4wvw-rgm4 — arbitrary file read on upload mirrors the arbitrary file write on download fixed in that advisory.
--- Suggested Fix
python src/mcpatlassian/confluence/attachments.py — uploadattachment() Add after abspath conversion, before open():
try: validatesafepath(filepath) except ValueError as e: return {"success": False, "error": str(e)}
Same fix required in uploadattachments() and src/mcpatlassian/jira/attachments.py.
Other sources
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluenceuploadattachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files, credentials, or other readable host data to a Confluence page and retrieve it through Atlassian. The advisory traces the vulnerable input and processing flow through confluenceuploadattachment, filepath, and open(filepath, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which deployments are affected?
MCP Atlassian versions before 0.22.0 are affected. The vulnerable functionality is the confluence_upload_attachment entry point.
What access does an attacker need to exploit this issue?
An attacker needs low-level privileges to invoke the affected MCP functionality; no user interaction is required. They can supply a server-local file path that is readable by the MCP Atlassian process.
What data could be exposed?
Readable host files, including environment files and credentials, can be uploaded to a Confluence page and then retrieved through Atlassian. The impact depends on the files accessible to the MCP Atlassian process.
How can I remediate the issue?
Upgrade MCP Atlassian to version 0.22.0 or later. The fix ensures that the resolved file path is checked to remain within the workspace.