GHSA-p6hp-93wp-fh6p: Path Traversal

Summary

mcp-atlassian exposes an MCP tool confluenceuploadattachment whose filepath argument is passed directly to open(filepath, "rb") without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart upload directed at an attacker-controlled Confluence host. In the default streamable-http transport the server binds 0.0.0.0 with no built-in authentication, making this remotely exploitable without credentials.

This is the read-side symmetric twin of GHSA-xjgw-4wvw-rgm4 / CVE-2026-27825 (fixed in v0.17.0). The v0.17.0 patch only covered the download/write path; the upload path that reads local files was left unguarded.

Details

Vulnerable sink src/mcpatlassian/confluence/attachments.py:477 python with open(filepath, "rb") as fp: files = {"file": (filename, fp, contenttype)} response = self.confluence.session.post(url, files=files, ...) filepath is attacker-controlled end-to-end.

Taint source src/mcpatlassian/servers/confluence.py:1290-1369, tool definition at :1307: python filepath: Annotated[str, Field(description="Absolute path to the file to upload")] No Pydantic pattern=, no validator, no validatesafepath() call.

Call chain 1. MCP client invokes confluenceuploadattachment(pageid, filepath, ...) 2. Server handler forwards to ConfluenceFetcher.uploadattachment(filepath) 3. uploadattachmentdirect(filepath) calls open(filepath, "rb") 4. File bytes are streamed in the multipart body of POST /wiki/rest/api/content/{pageid}/child/attachment to the configured Confluence base URL — which the attacker also controls (they provided CONFLUENCEURL via env/config or target a server they already control).

Asymmetry with the patched download path - attachments.py:223 (download) — calls validatesafepath(localpath) before open(..., "wb") - attachments.py:272 (download) — calls validatesafepath(localpath) before open(..., "wb") - attachments.py:477 (upload) — no validation

The checkwriteaccess decorator does not help: it only gates READONLYMODE (default false) and is unrelated to filesystem path safety.

Default exposure src/mcpatlassian/init.py:151 and :360 — default transport is streamable-http binding HOST=0.0.0.0 with no auth layer. Any network-reachable attacker can call MCP tools directly.

Severity

Primary (default streamable-http deployment) - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Score: 9.3 Critical - Rationale: network-reachable, unauthenticated, scope-changed because files outside the MCP server's intended resource boundary (Confluence attachments) are exfiltrated.

Alternative (stdio-only deployment, conservative) - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Score: 6.6 High - Rationale: local attacker controlling the MCP client context.

Maintainer should pick the vector that reflects the documented default deployment.

CWE CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected - Product: sooperset/mcp-atlassian - Affected versions: >= 0.17.0, <= HEAD (d8bc78698a63cb6b321c7ca796d6329d448f7f6d) - Note: v0.17.0 is the fix commit for GHSA-xjgw-4wvw-rgm4 but only addressed the write-side. This read-side twin has existed since that release and remains unpatched on main. - Patched versions: none at time of disclosure

Proof of Concept

Fully reproduced twice end-to-end against a local stdlib HTTP stub acting as the Confluence API, driven by a real MCP stdio client (mcp.ClientSession + stdioclient) spawning the unmodified mcp-atlassian server at HEAD.

Permalinks (commit-pinned) - Sink: https://github.com/sooperset/mcp-atlassian/blob/d8bc78698a63cb6b321c7ca796d6329d448f7f6d/src/mcpatlassian/confluence/attachments.py#L477 - Source (tool def): https://github.com/sooperset/mcp-atlassian/blob/d8bc78698a63cb6b321c7ca796d6329d448f7f6d/src/mcpatlassian/servers/confluence.py#L1307 - Safe download comparison: https://github.com/sooperset/mcp-atlassian/blob/d8bc78698a63cb6b321c7ca796d6329d448f7f6d/src/mcpatlassian/confluence/attachments.py#L223 - Default transport bind: https://github.com/sooperset/mcp-atlassian/blob/d8bc78698a63cb6b321c7ca796d6329d448f7f6d/src/mcpatlassian/init.py#L151

Reproduction 1. Start mock Confluence stub: python mockconfluence.py (binds 127.0.0.1:8443, logs all multipart bodies) 2. Launch MCP client against real mcp-atlassian server over stdio with CONFLUENCEURL=http://127.0.0.1:8443 3. Call tool: json { "name": "confluenceuploadattachment", "arguments": { "pageid": "123456", "filepath": "/etc/passwd", "comment": "poc" } }

Run 1 — /etc/passwd - MCP response: isError=False, {"message": "Attachment uploaded successfully"} - Stub captured 3339-byte multipart body containing: root:x:0:0:root:/root:/bin/bash (and full passwd contents)

Run 2 — /etc/hostname - MCP response: isError=False, same success envelope - Stub captured 380-byte body containing: ang3l-pc

Both runs used unmodified server code at commit d8bc78698a63cb6b321c7ca796d6329d448f7f6d. PoC artifacts (mockconfluence.py, mcpclient.py, pocrun1.sh, pocrun2.sh, asymmetry.txt, ENVIRONMENT.md) available on request to maintainers via this advisory thread.

Impact - Arbitrary file read of anything readable by the server process UID: /etc/passwd, /etc/shadow (if running as root in container), ~/.aws/credentials, ~/.ssh/idrsa, .env files, kube service-account tokens at /var/run/secrets/kubernetes.io/serviceaccount/token, application source, database dumps, private keys. - Exfiltration is covert: file bytes transit to the attacker's configured Confluence host inside a normal-looking multipart upload. No error surface; the tool returns success. - In the default streamable-http 0.0.0.0 deployment, no credentials are required. - Chains trivially with any AI agent that exposes this MCP server to untrusted prompt input — a prompt-injected assistant can be coerced into calling the tool with a sensitive path.

Relationship to GHSA-xjgw-4wvw-rgm4 (CVE-2026-27825) GHSA-xjgw-4wvw-rgm4 (CVSS 9.1, fixed in v0.17.0) addressed an arbitrary file write in the same attachments.py module: attacker-controlled paths reaching open(..., "wb") on the download side. The fix introduced validatesafepath() and applied it at lines 223 and 272.

The upload-side counterpart at line 477 was not updated. Same module, same maintainer, same class of bug (unchecked path → open()), opposite direction (read vs write). This advisory reports the incomplete-fix twin.

Remediation

Required Call validatesafepath(filepath) at the top of ConfluenceFetcher.uploadattachment and uploadattachmentdirect in src/mcpatlassian/confluence/attachments.py, mirroring the download path at lines 223 and 272. Reject absolute paths outside a configurable allow-listed upload directory and reject any path containing .. after normalization.

Defense in depth Tighten the Pydantic tool schema at src/mcpatlassian/servers/confluence.py:1307: python filepath: Annotated[ str, Field( description="Relative path within the configured upload directory", pattern=r"^(?!/)(?!.\.\.)[\w\-./]+$", ), ] This blocks absolute paths and .. at the MCP schema layer before the handler is even entered.

Additional hardening (out of scope but recommended) - Default streamable-http to 127.0.0.1 instead of 0.0.0.0, or require an auth token when bound to a non-loopback interface. - Document that filepath must be confined to an operator-chosen directory and expose that directory via config.