{"data":{"id":"8c090e4b-fe1d-4280-b87b-4e81df892192","title":"GHSA-93xw-j965-9mx3: MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()","summary":"The upload_attachment method in confluence/attachments.py of mcp-atlassian reads and uploads arbitrary local files to Confluence without calling validate_safe_path(), although the download methods do call it. An MCP-connected AI agent, or an attacker influencing it through prompt injection, can read any file the server process can access, such as SSH keys, AWS credentials or .env files, and exfiltrate it as a Confluence page attachment. The issue was reproduced with mcp-atlassian 0.21.1 on Python 3.11.","solution":"Add validate_safe_path(file_path) before the os.path.exists() check in upload_attachment, matching the existing pattern in the download methods. The function is already imported in that file.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-93xw-j965-9mx3","publishedAt":"2026-09-22T20:36:37.000Z","cveId":"CVE-2026-77258","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["mcp-atlassian@< 0.22.0 (fixed: 0.22.0)"],"affectedPackageNames":["mcp-atlassian"],"affectedPackageRefs":["pypi:mcp-atlassian"],"affectedVendors":[],"affectedVendorsRaw":["MCP Atlassian","Confluence","Atlassian"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00374,"epssCheckedAt":"2026-11-10T18:05:33.319Z","kevDateAdded":null,"advisoryAliases":["GHSA-93xw-j965-9mx3"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-22T20:36:37.000Z","fixReleasedAt":"2026-07-10T13:40:13.653Z","daysToFix":-74,"fixCheckedAt":"2026-10-29T21:30:17.335Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"pypi","name":"mcp-atlassian","fixedVersion":"0.22.0","matchedVersion":"0.22.0","fixReleasedAt":"2026-07-10T13:40:13.653Z","daysToFix":-74,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:17.190Z"}]}}