{"data":{"id":"cb55dfbc-9a1c-4fab-9e92-e7d6a1839752","title":"GHSA-g5r6-gv6m-f5jv: mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment","summary":"The mcp-atlassian server's confluence_upload_attachment tool passes a caller-supplied file_path directly to open() in _upload_attachment_direct() in src/mcp_atlassian/confluence/attachments.py, without the validate_safe_path() check that download_attachment() applies. Any authenticated MCP client, or an AI agent steered by prompt injection, can read files the server process can access and upload them to Confluence as attachments. The source reports this was confirmed against v0.21.1 and that /proc/self/environ, which can expose API tokens and other secrets on a Linux deployment, was exfiltrated.","solution":"Add validate_safe_path(file_path) before the open() call in _upload_attachment_direct(), as the source proposes.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-g5r6-gv6m-f5jv","publishedAt":"2026-07-10T19:34:37.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection","data_extraction"],"issueType":"vulnerability","affectedPackages":["mcp-atlassian@< 0.22.0 (fixed: 0.22.0)"],"affectedPackageNames":["mcp-atlassian"],"affectedPackageRefs":["pypi:mcp-atlassian"],"affectedVendors":[],"affectedVendorsRaw":["mcp-atlassian","Confluence","Jira","Open WebUI","qwen2.5:7b"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-g5r6-gv6m-f5jv"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-10T19:34:37.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":["AML.T0051"]}}