Lucene search
+L

7 matches found

PyPA
PyPA
•added 2026/10/01 4:38 p.m.•10 views

MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

SummaryThe uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath. Both download methods downloadattachment at line 223, downloadcontentattachments at line 272 correctly call validatesafepath before writing files...

7.7CVSS6.4AI score0.0034EPSS
SaveExploits1References8Affected Software1
Rows per page
Query Builder