MCP Atlassian EUVD-2026-84744

Requires a caller able to invoke the confluence_upload_attachment MCP tool against an mcp-atlassian server older than 0.22.0, and the server process must run with credentials/permissions granting Confluence upload plus filesystem read access to the target files. The specific defective control is that confluence_upload_attachment applies no path restriction (unlike the download path fixed for CVE-2026-27825), so a relative/absolute traversal file_path escapes the workspace. Limiting factors: the attacker must already reach the tool (local user in default stdio transport, or a network client if the unauthenticated streamable-HTTP transport is enabled), exfiltration depends on the caller being able to read the uploaded attachment back, and impact is bounded to files readable by the server's OS user. This is not exploitable against a patched (>=0.22.0) instance.

The vendor CVSS of 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) rates this a high-severity confidentiality-only flaw: an arbitrary file-read via path traversal in confluence_upload_attachment. No EPSS score, no CISA KEV listing, and no public POC accompany this record, so the exploitation signal is 'no public exploit identified at time of analysis' - the only exploit-relevant artifacts are the fix PR/commit and advisory, which describe the flaw but are not weaponized code. Two signals warrant caution against taking the raw 8.6 at face value: (1) the description repeatedly says 'a caller' and frames this as a caller-supplied file_path, which implies a permitted MCP caller must already reach the tool - that argues for PR:L rather than the vendor's PR:N, unless the server runs the unauthenticated HTTP transport (cf. the batch's root auth-bypass CVE-2026-77244), in which case PR:N is defensible; verify the deployment's transport/auth mode. (2) Scope-changed (S:C) is arguable for a same-process file read with no cross-system effect - sibling path-traversal CVEs in the same PR#1448 batch (CVE-2026-77258, CVE-2026-77270) were scored S:U/PR:L at 7.7/6.5, so this record's PR:N+S:C is inconsistent with its near-twins. Net: a real but gated confidentiality issue whose realistic priority is moderate - it depends on the caller already being able to invoke the tool and on the server holding broad Confluence credentials, and the affected product has a small real-world footprint.

An MCP caller permitted to invoke confluence_upload_attachment supplies a file_path such as '../../../../etc/passwd' or a path to app secrets/config; because the download-side path restriction (from CVE-2026-27825) was never applied to the upload path, the server reads the arbitrary host-readable file and uploads it as a Confluence attachment, which the caller then reads back to exfiltrate it. No public exploit code exists, but the flaw is trivially exploitable (AC:L) once tool access is obtained.