GHSA-mrq8-fv7v-hhjg: Path Traversal
sooperset/mcp-atlassian: HTTP upload tools can attach arbitrary server-local files
Date: 2026-05-05 Target: sooperset/mcp-atlassian Commit: d8bc78698a63cb6b321c7ca796d6329d448f7f6d
Summary
mcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode, write-capable Jira and Confluence attachment flows accept caller-controlled server-local file paths and read those paths without an upload-source allowlist or base directory restriction.
An authenticated caller, or a prompt-injected agent with tool-call capability, can cause the MCP server process to read a local file it can access and attach that file into a Jira issue or Confluence page using configured Atlassian credentials.
This is distinct from the prior download-path advisory: that issue was an arbitrary file write sink. This path is upload-source local file disclosure.
Impact
Impact is local file disclosure through an authenticated Atlassian attachment write. In Docker/Kubernetes deployments that mount .env or token material into the service, exposed files may include API tokens, OAuth credentials, service configuration, or other local secrets readable by the MCP process.
The issue is bounded by tool access and Atlassian permissions: the attacker needs an MCP call path to a write tool and an issue/page where the attachment can be written. It is not direct RCE.
Severity is Medium-to-High depending on deployment:
- Medium for single-user/local stdio usage or tightly scoped tokens. - High where HTTP/streamable deployments are shared, write tools are exposed, and the server has access to secrets or broad filesystem mounts.
Source Evidence
HTTP/multi-user deployment is first-class:
- docs/http-transport.mdx:1-7 describes running as a persistent HTTP service for multi-user and remote deployment. - docs/http-transport.mdx:10-13 lists SSE and streamable-http endpoints. - docs/http-transport.mdx:88-90 says both HTTP transports support per-request authentication. - docs/advanced/docker-production.mdx:25-37 shows Docker deployment with .env, exposed ports, and HOST=0.0.0.0. - docs/advanced/docker-production.mdx:91-103 shows Atlassian credentials stored in .env. - src/mcpatlassian/init.py:359-363 defaults HTTP host to 0.0.0.0 unless overridden.
The Confluence upload path reads caller-chosen server-local files:
- src/mcpatlassian/servers/confluence.py:1290-1315 exposes filepath and explicitly accepts absolute or relative paths. - src/mcpatlassian/servers/confluence.py:1356-1363 passes filepath to confluencefetcher.uploadattachment. - src/mcpatlassian/confluence/attachments.py:62-70 only converts relative paths to absolute and checks existence. - src/mcpatlassian/confluence/attachments.py:77-80 passes the path to uploadattachmentdirect. - src/mcpatlassian/confluence/attachments.py:477 opens filepath for the multipart upload.
The Jira update path can also upload caller-chosen server-local files:
- src/mcpatlassian/servers/jira.py:1564-1568 exposes jiraupdateissue as a write tool in toolset:jiraissues. - src/mcpatlassian/servers/jira.py:1609-1618 accepts attachments as a JSON array or comma-separated list of file paths. - src/mcpatlassian/servers/jira.py:1648-1674 parses those file paths and adds them to the update payload. - src/mcpatlassian/jira/issues.py:1132-1137 forwards attachments to uploadattachments. - src/mcpatlassian/jira/attachments.py:372-389 converts relative paths to absolute, checks existence, opens the path, and passes it to jira.addattachment.
Existing controls do not authorize the upload source path:
- src/mcpatlassian/utils/decorators.py:45-72 blocks writes only when read-only mode is enabled. - src/mcpatlassian/servers/main.py:276-279 filters write tools out of listing only in read-only mode. - src/mcpatlassian/utils/toolsets.py:158-183 currently enables all toolsets when TOOLSETS is unset. - docs/advanced/docker-production.mdx:109-119 documents READONLYMODE=true as an optional production hardening setting, not a default. - src/mcpatlassian/confluence/attachments.py:217-223 and src/mcpatlassian/jira/attachments.py:37-43 show validatesafepath exists for download destinations, but no equivalent upload-source containment is applied.
Root cause
The codebase already has a path-containment primitive (validatesafepath) and applies it to download destinations to prevent writes outside a configured base directory — that is, it correctly defends the filesystem-write side of the boundary. But the upload-source side of the same boundary is not defended at all: the Confluence and Jira attachment paths convert caller-supplied paths to absolute, check that the file exists, open it, and stream the bytes to Atlassian, with no equivalent "must resolve inside an upload base directory" check. The authorization model implicitly treats "the MCP process can read this file" as equivalent to "the MCP caller is authorized to upload this file," which is correct only for single-user stdio mode. For HTTP/SSE multi-user mode (which the project documents as first-class and ships with HOST=0.0.0.0), it is not — caller identity and process filesystem-read capability are different boundaries. The structural fix is to apply the existing validatesafepath containment primitive to upload-source paths under a separate UPLOADBASEDIR configuration, and to disable server-local upload tools by default in HTTP transport mode unless that base directory is configured.
Auth boundary violated
Boundary: Per-user resource ownership (in HTTP/SSE multi-user mode, an authenticated MCP caller's tool surface should expose only files the caller is authorized to upload — not arbitrary files in the MCP process's filesystem view, including operator-mounted secrets and other tenants' data).
Respected at: src/mcpatlassian/confluence/attachments.py:217-223 and src/mcpatlassian/jira/attachments.py:37-43 (validatesafepath is correctly applied to download-destination paths to prevent writes outside a base directory).
Violated at: src/mcpatlassian/confluence/attachments.py:62-70,77-80,477 (Confluence upload path: relative-to-absolute conversion, existence check, then open(filepath), with no validatesafepath call against an upload base directory) and src/mcpatlassian/jira/attachments.py:372-389 (Jira upload path: identical pattern). The boundary is silently dropped: the same containment primitive that defends the download side is not invoked on the upload side.
Reproduction
Observed:
text CONFLUENCESINK contentid=attacker-visible-page-id filename=mcp-atlassian-poc-secret.txt CONFLUENCEEXFILMARKER=FAKESECRETMARKERDONOTPUBLISHREALSECRET CONFLUENCERESULT={'success': True, 'filename': 'mcp-atlassian-poc-secret.txt'} JIRASINK issuekey=ATTACKER-1 filename=mcp-atlassian-poc-secret.txt JIRAEXFILMARKER=FAKESECRETMARKERDONOTPUBLISHREALSECRET JIRARESULT={'success': True, 'filename': 'mcp-atlassian-poc-secret.txt'}
The PoC uses fake upload sinks and does not contact Atlassian. It demonstrates the vulnerable behavior: a caller-provided absolute server-local path is accepted, read, and delivered to the attachment sink.
Known Issue / Dupe Checks
Known advisories are different:
- GHSA-xjgw-4wvw-rgm4: arbitrary file write through unconstrained Confluence download path. - GHSA-7r34-79r5-rcc9: SSRF through unvalidated Atlassian URL headers.
Closest public non-security overlap:
- issue #618: usability report that upload requires server-side paths. - issue #1163: unrelated upload failure on Data Center. - PRs #987 / #949: download-path hardening, not upload-source path containment.
No public issue/PR/advisory found for upload-side arbitrary local file read.
Suggested Fix
Add an explicit upload source policy, for example:
- require MCPATLASSIANUPLOADBASEDIR for server-local upload tools in HTTP/SSE/streamable mode - reject absolute paths unless they resolve inside that configured base directory - apply validatesafepath(path, basedir=uploadbasedir) before existence checks or reads - consider disabling server-local upload tools by default in HTTP mode unless an upload directory is configured
Add regression tests for both Confluence and Jira upload paths:
- reject /etc/passwd - reject ../../../etc/passwd - reject symlinks escaping the upload base - accept a file inside the configured upload directory - verify READONLYMODE=true still blocks the write independently
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mcp-atlassianto a version that resolves this vulnerability.Fixed in 0.22.0 - Configuration
Require MCP_ATLASSIAN_UPLOAD_BASE_DIR for server-local upload tools in HTTP/SSE/streamable mode, disable those tools when it is unset, and apply validate_safe_path(path, base_dir=upload_base_dir) before existence checks or reads. Reject traversal paths such as ../../../etc/passwd, absolute paths outside the base directory, and symlinks escaping the base.
mcp-atlassian HTTP/SSE/streamable HTTP upload tools MCP_ATLASSIAN_UPLOAD_BASE_DIR = configured upload directory - Configuration
Enable READ_ONLY_MODE=true to block write tools, including Jira and Confluence attachment uploads, when server-local uploads are not required.
mcp-atlassian READ_ONLY_MODE = true
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using mcp-atlassian in HTTP/SSE mode for persistent, remote, or multi-user access are exposed when callers can invoke Jira or Confluence attachment write flows. The risk includes authenticated users and agents that can make tool calls after prompt injection.
What does an attacker need to exploit it?
An attacker needs the ability to supply a file path to a write-capable Jira or Confluence attachment flow. The MCP server process must also have read access to the targeted local file and configured Atlassian credentials capable of creating attachments.
Are containerized deployments at particular risk?
Yes. Docker or Kubernetes deployments may expose mounted .env files, token material, API tokens, OAuth credentials, service configuration, or other secrets that the MCP process can read.
What changes address the issue?
The referenced fix is commit b041733473f95119dd539542a43c280737a8e460. The described weakness is the absence of an upload-source allowlist or base-directory restriction, so controls that limit attachment sources to an approved directory reduce exposure.