MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

SummaryThe Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment.In local stdio deployments, this can expose files readable by the user's MCP proces...

PYSEC-2026-4088 MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()

Summary The uploadattachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validatesafepath. Both download methods downloadattachment at line 223, downloadcontentattachments at line 272 correctly call validatesafepath before writing file...

PYSEC-2026-4092 MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

Summary The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment. In local stdio deployments, this can expose files readable by the user's MCP...

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

SummaryA critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent ca...

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

SummaryThe uploadattachment functions in both the Jira and Confluence modules accept a user-controlled filepath parameter and open the specified file for reading without calling validatesafepath. An authenticated MCP client can supply an arbitrary path such as /etc/passwd or /proc/self/environ,...

PYSEC-2026-4099 MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

Summary mcp-atlassian exposes an MCP tool confluenceuploadattachment whose filepath argument is passed directly to openfilepath, "rb" without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart uploa...

MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

SummaryThis is an arbitrary local file READ vulnerability on the Confluence and Jira uploadattachment tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open.Reporter: Sean...

MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

SummaryThe upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The uploadattachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validatesafepath...

PYSEC-2026-4098 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

sooperset/mcp-atlassian: HTTP upload tools can attach arbitrary server-local files Date: 2026-05-05 Target: sooperset/mcp-atlassian Commit: d8bc78698a63cb6b321c7ca796d6329d448f7f6d Summary mcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode,...

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

SummaryMissing path validation in confluenceuploadattachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call.---...

PYSEC-2026-4091 MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)

Summary This is an arbitrary local file READ vulnerability on the Confluence and Jira uploadattachment tool paths. It's the symmetric counterpart of the file-write vulnerability you patched as CVE-2026-27825. The write direction was fixed; the read direction was left open. Reporter: Sean Valentin...

PYSEC-2026-4080 MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

Summary A critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent c...

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

SummaryThe confluenceuploadattachment and confluenceuploadattachments MCP tools accept a filepath parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process SS...

MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

SummaryMCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MC...

MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

Summarymcp-atlassian exposes an MCP tool confluenceuploadattachment whose filepath argument is passed directly to openfilepath, "rb" without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart upload...

PYSEC-2026-4086 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

Summary Missing path validation in confluenceuploadattachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call. --- Details...

PYSEC-2026-4097 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call

Summary The uploadattachment functions in both the Jira and Confluence modules accept a user-controlled filepath parameter and open the specified file for reading without calling validatesafepath. An authenticated MCP client can supply an arbitrary path such as /etc/passwd or /proc/self/environ,...

PYSEC-2026-4095 MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)

Summary The confluenceuploadattachment and confluenceuploadattachments MCP tools accept a filepath parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process S...

PYSEC-2026-4090 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

Summary The upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The uploadattachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validatesafepath...

PYSEC-2026-4101 MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files

Summary MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the M...