HighVulnerability
GHSA-g5r6-gv6m-f5jv: mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment
- Identifier
- GHSA-g5r6-gv6m-f5jv
- Published
- Record updated
- Affected
- mcp-atlassian < 0.22.0
- Fixed in
- 0.22.0
Summary
The mcp-atlassian server's confluence_upload_attachment tool passes a caller-supplied file_path directly to open() in _upload_attachment_direct() in src/mcp_atlassian/confluence/attachments.py, without the validate_safe_path() check that download_attachment() applies. Any authenticated MCP client, or an AI agent steered by prompt injection, can read files the server process can access and upload them to Confluence as attachments. The source reports this was confirmed against v0.21.1 and that /proc/self/environ, which can expose API tokens and other secrets on a Linux deployment, was exfiltrated.
Mitigation
Add validate_safe_path(file_path) before the open() call in _upload_attachment_direct(), as the source proposes.
Topics
Related items
- MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
- HighCVE-2026-110206: Roo Code command approval bypass in parseCommandLine() via command substitutionSimilar attack · NVD/CVE Database
- HighCVE-2026-110205: Roo Code command approval bypass through parseCommandLine() command substitutionSimilar attack · NVD/CVE Database
- HighCVE-2026-110204: Roo Code command approval bypass through parseCommandLine substitutionsSimilar attack · NVD/CVE Database
- HighCVE-2026-110203: Roo Code command approval bypass via quote-masking regexSimilar attack · NVD/CVE Database