GHSA-h7wj-5v37-59r2: Path Traversal

Summary

The confluenceuploadattachment and confluenceuploadattachments MCP tools accept a filepath parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process (SSH keys, .env files, API credentials) and exfiltrate it by uploading it to Confluence.

Note: The Jira uploadattachment mixin method in jira/attachments.py has the same missing validation, but it is NOT registered as an MCP tool in servers/jira.py and is therefore not currently reachable via MCP. It should still be patched to prevent future exposure if Jira upload tools are added.

This is an incomplete fix for CVE-2026-27825. That CVE was patched by adding validatesafepath() to download operations (v0.17.0). The same protection was not applied to upload operations.

Details

validatesafepath() is imported in both confluence/attachments.py and jira/attachments.py and is correctly called in all download functions. It is absent from the Confluence upload functions (which are exposed as MCP tools) and from the Jira upload mixin methods (which are not currently registered as MCP tools but should still be patched).

Download (protected — correctly patched): python confluence/attachments.py:222-223 validatesafepath(targetpath) # resolves symlinks + checks isrelativeto(cwd)

Upload (vulnerable — not patched): python confluence/attachments.py:64-79 — NO validatesafepath() call if not os.path.isabs(filepath): filepath = os.path.abspath(filepath) # normalizes but does NOT restrict ... files = {"file": (filename, open(filepath, "rb"))} # opens arbitrary file

Same pattern in jira/attachments.py:386.

Proof of Concept

python Call via MCP client await session.calltool("confluenceuploadattachment", { "contentid": "12345", "filepath": "/home/user/.ssh/idrsa" # absolute path — no traversal needed }) SSH private key is now a Confluence attachment Retrieve via: confluencedownloadattachment or Confluence UI

Impact

Arbitrary file read from the server filesystem. High-value targets: SSH private keys, .env files, AWS/GCP credentials, database configuration, source code.

Fix

Add validatesafepath(filepath) call in confluence/attachments.py:uploadattachment() (reachable via MCP) and jira/attachments.py:uploadattachment() (not currently reachable via MCP, but should be patched preventively), consistent with the existing download protection. No changes to validatesafepath() itself are needed.

python Add after os.path.abspath() call: try: validatesafepath(filepath) except ValueError as e: return {"success": False, "error": str(e)}