GHSA-mrq8-fv7v-hhjg CVE-2026-77257 PYSEC-2026-4098

MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

Medium PyPI

Severity: 0.0 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 0.39%; Chance of exploitation in the next 30 days. Higher than 32.71% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Fix: 0.22.0; Upgrade mcp-atlassian to this version or later

Description

sooperset/mcp-atlassian: HTTP upload tools can attach arbitrary server-local files

Date: 2026-05-05 Target: sooperset/mcp-atlassian Commit: d8bc78698a63cb6b321c7ca796d6329d448f7f6d

Summary

mcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode, write-capable Jira and Confluence attachment flows accept caller-controlled server-local file paths and read those paths without an upload-source allowlist or base directory restriction.

An authenticated caller, or a prompt-injected agent with tool-call capability, can cause the MCP server process to read a local file it can access and attach that file into a Jira issue or Confluence page using configured Atlassian credentials.

This is distinct from the prior download-path advisory: that issue was an arbitrary file write sink. This path is upload-source local file disclosure.

Impact

Impact is local file disclosure through an authenticated Atlassian attachment write. In Docker/Kubernetes deployments that mount .env or token material into the service, exposed files may include API tokens, OAuth credentials, service configuration, or other local secrets readable by the MCP process.

The issue is bounded by tool access and Atlassian permissions: the attacker needs an MCP call path to a write tool and an issue/page where the attachment can be written. It is not direct RCE.

Severity is Medium-to-High depending on deployment:

Medium for single-user/local stdio usage or tightly scoped tokens.
High where HTTP/streamable deployments are shared, write tools are exposed, and the server has access to secrets or broad filesystem mounts.

Source Evidence

HTTP/multi-user deployment is first-class:

docs/http-transport.mdx:1-7 describes running as a persistent HTTP service for multi-user and remote deployment.
docs/http-transport.mdx:10-13 lists SSE and streamable-http endpoints.
docs/http-transport.mdx:88-90 says both HTTP transports support per-request authentication.
docs/advanced/docker-production.mdx:25-37 shows Docker deployment with .env, exposed ports, and HOST=0.0.0.0.
docs/advanced/docker-production.mdx:91-103 shows Atlassian credentials stored in .env.
src/mcp_atlassian/__init__.py:359-363 defaults HTTP host to 0.0.0.0 unless overridden.

The Confluence upload path reads caller-chosen server-local files:

src/mcp_atlassian/servers/confluence.py:1290-1315 exposes file_path and explicitly accepts absolute or relative paths.
src/mcp_atlassian/servers/confluence.py:1356-1363 passes file_path to confluence_fetcher.upload_attachment.
src/mcp_atlassian/confluence/attachments.py:62-70 only converts relative paths to absolute and checks existence.
src/mcp_atlassian/confluence/attachments.py:77-80 passes the path to _upload_attachment_direct.
src/mcp_atlassian/confluence/attachments.py:477 opens file_path for the multipart upload.

The Jira update path can also upload caller-chosen server-local files:

src/mcp_atlassian/servers/jira.py:1564-1568 exposes jira_update_issue as a write tool in toolset:jira_issues.
src/mcp_atlassian/servers/jira.py:1609-1618 accepts attachments as a JSON array or comma-separated list of file paths.
src/mcp_atlassian/servers/jira.py:1648-1674 parses those file paths and adds them to the update payload.
src/mcp_atlassian/jira/issues.py:1132-1137 forwards attachments to upload_attachments.
src/mcp_atlassian/jira/attachments.py:372-389 converts relative paths to absolute, checks existence, opens the path, and passes it to jira.add_attachment.

Existing controls do not authorize the upload source path:

src/mcp_atlassian/utils/decorators.py:45-72 blocks writes only when read-only mode is enabled.
src/mcp_atlassian/servers/main.py:276-279 filters write tools out of listing only in read-only mode.
src/mcp_atlassian/utils/toolsets.py:158-183 currently enables all toolsets when TOOLSETS is unset.
docs/advanced/docker-production.mdx:109-119 documents READ_ONLY_MODE=true as an optional production hardening setting, not a default.
src/mcp_atlassian/confluence/attachments.py:217-223 and src/mcp_atlassian/jira/attachments.py:37-43 show validate_safe_path exists for download destinations, but no equivalent upload-source containment is applied.

Root cause

The codebase already has a path-containment primitive (validate_safe_path) and applies it to download destinations to prevent writes outside a configured base directory — that is, it correctly defends the filesystem-write side of the boundary. But the upload-source side of the same boundary is not defended at all: the Confluence and Jira attachment paths convert caller-supplied paths to absolute, check that the file exists, open it, and stream the bytes to Atlassian, with no equivalent "must resolve inside an upload base directory" check. The authorization model implicitly treats "the MCP process can read this file" as equivalent to "the MCP caller is authorized to upload this file," which is correct only for single-user stdio mode. For HTTP/SSE multi-user mode (which the project documents as first-class and ships with HOST=0.0.0.0), it is not — caller identity and process filesystem-read capability are different boundaries. The structural fix is to apply the existing validate_safe_path containment primitive to upload-source paths under a separate UPLOAD_BASE_DIR configuration, and to disable server-local upload tools by default in HTTP transport mode unless that base directory is configured.

Auth boundary violated

Boundary: Per-user resource ownership (in HTTP/SSE multi-user mode, an authenticated MCP caller's tool surface should expose only files the caller is authorized to upload — not arbitrary files in the MCP process's filesystem view, including operator-mounted secrets and other tenants' data).

Respected at: src/mcp_atlassian/confluence/attachments.py:217-223 and src/mcp_atlassian/jira/attachments.py:37-43 (validate_safe_path is correctly applied to download-destination paths to prevent writes outside a base directory).

Violated at: src/mcp_atlassian/confluence/attachments.py:62-70,77-80,477 (Confluence upload path: relative-to-absolute conversion, existence check, then open(file_path), with no validate_safe_path call against an upload base directory) and src/mcp_atlassian/jira/attachments.py:372-389 (Jira upload path: identical pattern). The boundary is silently dropped: the same containment primitive that defends the download side is not invoked on the upload side.

Reproduction

Observed:

CONFLUENCE_SINK content_id=attacker-visible-page-id filename=mcp-atlassian-poc-secret.txt
CONFLUENCE_EXFIL_MARKER=FAKE_SECRET_MARKER_DO_NOT_PUBLISH_REAL_SECRET
CONFLUENCE_RESULT={'success': True, 'filename': 'mcp-atlassian-poc-secret.txt'}
JIRA_SINK issue_key=ATTACKER-1 filename=mcp-atlassian-poc-secret.txt
JIRA_EXFIL_MARKER=FAKE_SECRET_MARKER_DO_NOT_PUBLISH_REAL_SECRET
JIRA_RESULT={'success': True, 'filename': 'mcp-atlassian-poc-secret.txt'}

The PoC uses fake upload sinks and does not contact Atlassian. It demonstrates the vulnerable behavior: a caller-provided absolute server-local path is accepted, read, and delivered to the attachment sink.

Known Issue / Dupe Checks

Known advisories are different:

GHSA-xjgw-4wvw-rgm4: arbitrary file write through unconstrained Confluence download path.
GHSA-7r34-79r5-rcc9: SSRF through unvalidated Atlassian URL headers.

Closest public non-security overlap:

issue #618: usability report that upload requires server-side paths.
issue #1163: unrelated upload failure on Data Center.
PRs #987 / #949: download-path hardening, not upload-source path containment.

No public issue/PR/advisory found for upload-side arbitrary local file read.

Suggested Fix

Add an explicit upload source policy, for example:

require MCP_ATLASSIAN_UPLOAD_BASE_DIR for server-local upload tools in HTTP/SSE/streamable mode
reject absolute paths unless they resolve inside that configured base directory
apply validate_safe_path(path, base_dir=upload_base_dir) before existence checks or reads
consider disabling server-local upload tools by default in HTTP mode unless an upload directory is configured

Add regression tests for both Confluence and Jira upload paths:

reject /etc/passwd
reject ../../../etc/passwd
reject symlinks escaping the upload base
accept a file inside the configured upload directory
verify READ_ONLY_MODE=true still blocks the write independently

Affected versions

PyPI

Package	Vulnerable	Fixed in
mcp-atlassian	`< 0.22.0`	`0.22.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

mcp-atlassian PyPI → `0.22.0`

pip

pip install --upgrade "mcp-atlassian>=0.22.0"

poetry

poetry add "mcp-atlassian>=0.22.0"

uv

uv add "mcp-atlassian>=0.22.0"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality (vulnerable system): High
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): High
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Weakness

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

How to prevent it

Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434. Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would b
Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked. Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23, CWE-59). This includes: realpath() in C getCanonicalPath() in Java GetFullPath() in ASP.NET realpath() or abs_path() in Perl realpath() in PHP
Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Operation: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Architecture and Design: When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-185] provide this capability.
Architecture and Design, Operation: Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
Architecture and Design, Operation: Store library, include, and utility files outside of the web document root, if possible. Otherwise, store them in a separate directory and use the web server's access control capabilities to prevent attackers from directly requesting them. One common practice is to define a fixed constant in each calling program, then check for the existence of the constant in the library/include file; if the constant does not exist, then the file was directly requested, and it can exit immediately. This significantly reduces the chance of an attacker being able to bypass any protection mechanisms that are in the base program but not in the include files. It will also reduce the attack surface.
Implementation: Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not. In the context of path traversal, error messages which disclose path information can help attackers craft the appropriate attack strings to move through the file system hierarchy.
Operation, Implementation: When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.

References

Advisories

Packages

Timeline

Sep 22, 2026 Published
Oct 1, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-g2r2-3j32-j27x MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler	Medium	Also affects mcp-atlassian
GHSA-h7wj-5v37-59r2 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)	Medium	Also affects mcp-atlassian
GHSA-4596-2p6p-28cv MCP Atlassian: Insecure File Permissions on OAuth Token Storage	Medium	Also affects mcp-atlassian
GHSA-mfv2-4wvm-9pgp MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call	Medium	Also affects mcp-atlassian
GHSA-p6hp-93wp-fh6p MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)	High	Also affects mcp-atlassian
GHSA-6cr4-ccf3-x7h4 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials	High	Also affects mcp-atlassian
GHSA-2xj6-xx86-cwwc MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue	High	Also affects mcp-atlassian
GHSA-vc25-24vv-fxxm MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files	High	Also affects mcp-atlassian

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor