3 matches found
MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()
Summary The uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath. Both download methods downloadattachment at line 223, downloadcontentattachments at line 272 correctly call validatesafepath before writing file...
7.7CVSS6.2AI score0.00481EPSS
SaveExploits0References6Affected Software1
20