GHSA-6cr4-ccf3-x7h4

Suggest an improvement
Source
https://github.com/advisories/GHSA-6cr4-ccf3-x7h4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6cr4-ccf3-x7h4/GHSA-6cr4-ccf3-x7h4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6cr4-ccf3-x7h4
Aliases
Published
2026-09-22T20:35:16Z
Modified
2026-09-22T21:00:04Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials
Details

Summary

Missing path validation in confluence_upload_attachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call.

Details

AttachmentsMixin.upload_attachment() in src/mcp_atlassian/confluence/attachments.py opens the caller-supplied file_path with no boundary check:

# line 477
files = {"file": (filename, open(file_path, "rb"))}

The download path was correctly hardened in GHSA-xjgw-4wvw-rgm4 via validate_safe_path() (lines 223, 272). That fix was not applied to the upload path, leaving it completely unguarded. The MCP tool layer (servers/confluence.py:1295) passes file_path verbatim with no additional sanitization.

PoC

# 1. Prepare target file (macOS demo; on Linux use /proc/self/environ directly)
cp ~/.aws/credentials /tmp/diagram.png

# 2. Call the MCP tool
confluence_upload_attachment(
    content_id = "<any page attacker can edit>",
    file_path  = "/tmp/diagram.png"
)

# 3. Download attachment from Confluence — contains raw credentials

Tested on mcp-atlassian 0.21.1 against live Confluence Cloud. Attachment confirmed uploaded and retrieved with full credential content intact.

Impact

Any MCP client with edit access to one Confluence page can read arbitrary files from the server process. On shared/Docker deployments, /proc/self/environ exposes all users' API tokens in a single request. Exfiltrated Atlassian tokens provide persistent API access independent of MCP, surviving server shutdown or patching.

Incomplete fix of GHSA-xjgw-4wvw-rgm4 — arbitrary file read on upload mirrors the arbitrary file write on download fixed in that advisory.

Suggested Fix

# src/mcp_atlassian/confluence/attachments.py — upload_attachment()
# Add after abspath conversion, before open():

try:
    validate_safe_path(file_path)
except ValueError as e:
    return {"success": False, "error": str(e)}

Same fix required in upload_attachments() and src/mcp_atlassian/jira/attachments.py.

Database specific 
{
    "cwe_ids":  [
        "CWE-22",
        "CWE-552"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-22T20:35:16Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

PyPI / mcp-atlassian

Package

Name
mcp-atlassian
View open source insights on deps.dev
Purl
pkg:pypi/mcp-atlassian

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.22.0

Affected versions

0.*
0.1.1
0.1.2
0.1.3
0.1.4
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.3.0
0.3.1
0.4.0
0.5.0
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.11.0
0.11.1
0.11.2a2
0.11.2
0.11.3
0.11.4
0.11.5
0.11.6
0.11.7
0.11.8
0.11.9
0.11.10
0.11.11
0.11.12
0.12.0
0.13.0
0.13.1
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.16.0
0.16.1
0.17.0
0.18.0
0.18.1
0.19.0
0.20.0
0.20.1
0.21.0
0.21.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6cr4-ccf3-x7h4/GHSA-6cr4-ccf3-x7h4.json"