MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

Summary

mcp-atlassian exposes an MCP tool confluence_upload_attachment whose file_path argument is passed directly to open(file_path, "rb") without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart upload directed at an attacker-controlled Confluence host. In the default streamable-http transport the server binds 0.0.0.0 with no built-in authentication, making this remotely exploitable without credentials.

This is the read-side symmetric twin of GHSA-xjgw-4wvw-rgm4 / CVE-2026-27825 (fixed in v0.17.0). The v0.17.0 patch only covered the download/write path; the upload path that reads local files was left unguarded.

Details

Vulnerable sink

src/mcp_atlassian/confluence/attachments.py:477

with open(file_path, "rb") as fp:
    files = {"file": (filename, fp, content_type)}
    response = self.confluence.session.post(url, files=files, ...)

file_path is attacker-controlled end-to-end.

Taint source

src/mcp_atlassian/servers/confluence.py:1290-1369, tool definition at :1307:

file_path: Annotated[str, Field(description="Absolute path to the file to upload")]

No Pydantic pattern=, no validator, no validate_safe_path() call.

Call chain

1. MCP client invokes confluence_upload_attachment(page_id, file_path, ...)
2. Server handler forwards to ConfluenceFetcher.upload_attachment(file_path)
3. _upload_attachment_direct(file_path) calls