CVE-2026-77269: MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

CVE-2026-27825 was fixed in v0.17.0 by adding validate_safe_path() to download operations. This advisory reports that the upload functions were not covered. In confluence/attachments.py (lines 64 to 79), the code calls os.path.abspath(), which normalizes the path but does not restrict it, and then runs open(file_path, "rb").

The reporter's proof of concept calls confluence_upload_attachment with content_id 12345 and file_path /home/user/.ssh/id_rsa. An absolute path is enough; no ../ is needed. The key then sits on the Confluence page and can be fetched through confluence_download_attachment or the Confluence UI.

The Jira upload_attachment mixin in jira/attachments.py has the same gap. The reporter states it was not registered as an MCP tool in servers/jira.py at the time they tested, so it was not reachable that way. Other advisories in this release show the Jira path reachable through jira_update_issue's attachments field, so treat the Jira side as exposed too.

An attacker needs to be able to call the tools: an authenticated client, or a prompt injection against an agent that uses them. Targets are SSH private keys, .env files, AWS and GCP credentials, database configuration and source code.

mcp-atlassian below 0.22.0, through the Confluence upload tools. Every deployment that leaves write tools enabled is in scope.

pip show mcp-atlassian

Uvx and container installs: read the version pinned in the MCP client config or image tag.

Upgrade to 0.22.0:

pip install --upgrade mcp-atlassian==0.22.0

The reporter's fix adds validate_safe_path(file_path) to the Confluence upload_attachment and, preventively, to the Jira one, returning an error if the path is rejected. validate_safe_path() itself needs no change. Setting READ_ONLY_MODE=true removes the write tools, if you do not need them.

Look at Confluence page attachments added by the integration account, especially key files, .env copies and credential files. Check MCP call logs for confluence_upload_attachment or confluence_upload_attachments with file_path values outside the folder you expect to upload from. Beam records agent MCP tool calls, so the agent session behind a suspicious upload can be traced.

Summary

The confluence_upload_attachment and confluence_upload_attachments MCP tools accept a file_path parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process (SSH keys, .env files, API credentials) and exfiltrate it by uploading it to Confluence.

Note: The Jira upload_attachment mixin method in jira/attachments.py has the same missing validation, but it is NOT registered as an MCP tool in servers/jira.py and is therefore not currently reachable via MCP. It should still be patched to prevent future exposure if Jira upload tools are added.

This is an incomplete fix for CVE-2026-27825. That CVE was patched by adding validate_safe_path() to download operations (v0.17.0). The same protection was not applied to upload operations.

Details

validate_safe_path() is imported in both confluence/attachments.py and jira/attachments.py and is correctly called in all download functions. It is absent from the Confluence upload functions (which are exposed as MCP tools) and from the Jira upload mixin methods (which are not currently registered as MCP tools but should still be patched).

Download (protected — correctly patched):

# confluence/attachments.py:222-223
validate_safe_path(target_path)  # resolves symlinks + checks is_relative_to(cwd)

Upload (vulnerable — not patched):

# confluence/attachments.py:64-79 — NO validate_safe_path() call
if not os.path.isabs(file_path):
    file_path = os.path.abspath(file_path)  # normalizes but does NOT restrict
# ...
files = {"file": (filename, open(file_path, "rb"))}  # opens arbitrary file

Same pattern in jira/attachments.py:386.

Proof of Concept

# Call via MCP client
await session.call_tool("confluence_upload_attachment", {
    "content_id": "12345",
    "file_path": "/home/user/.ssh/id_rsa"  # absolute path — no traversal needed
})
# SSH private key is now a Confluence attachment
# Retrieve via: confluence_download_attachment or Confluence UI

Impact

Arbitrary file read from the server filesystem. High-value targets: SSH private keys, .env files, AWS/GCP credentials, database configuration, source code.

Fix

Add validate_safe_path(file_path) call in confluence/attachments.py:upload_attachment() (reachable via MCP) and jira/attachments.py:upload_attachment() (not currently reachable via MCP, but should be patched preventively), consistent with the existing download protection. No changes to validate_safe_path() itself are needed.

# Add after os.path.abspath() call:
try:
    validate_safe_path(file_path)
except ValueError as e:
    return {"success": False, "error": str(e)}