Lucene search
+L

3 matches found

Github Security Blog
Github Security Blog
added 2026/09/22 8:36 p.m.8 views

MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

Summary The uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath. Both download methods downloadattachment at line 223, downloadcontentattachments at line 272 correctly call validatesafepath before writing file...

7.7CVSS6.2AI score0.00481EPSS
SaveExploits0References6Affected Software1
Rows per page
Query Builder