EUVD-2026-84758
GHSA-6cr4-ccf3-x7h4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain permitted MCP caller access
-
DeliveryCall confluence_upload_attachment with file_path to host secret
-
ExploitServer opens unvalidated path, reads file
-
ExecutionAttachment posted to Confluence page
-
ImpactRetrieve exfiltrated data via Atlassian
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the attacker is an accepted MCP caller (PR:L) reaching a mcp-atlassian server older than 0.22.0 that is configured with operator/global Atlassian credentials capable of writing Confluence attachments - the classic confused-deputy setup is a shared-credential or multi-user/HTTP-transport deployment where the caller is not fully trusted with host filesystem contents. Exploitation is limited by: the need for pre-existing tool-invocation privilege, a Confluence space the credential can upload to and the attacker can read back, and it fails against single-user local stdio deployments where the caller already owns the host. No user interaction is required. Default relative-path handling only applied os.path.abspath, providing no workspace confinement. |
| Impact | This is a genuine but access-gated arbitrary-file-read vulnerability, not a high-CVSS scare. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N = 7.7) correctly reflects confidentiality-only impact with no integrity or availability effect. There is no EPSS score, no CISA KEV listing, and no public exploit code provided - exploitation status is 'no public exploit identified at time of analysis.' The vector requires PR:L (authenticated/permitted caller), which meaningfully limits blast radius: the attacker must already be a caller the MCP server accepts. The S:C (scope changed) claim is questionable - the file is read within the same MCP host trust boundary and exfiltrated through the operator's already-configured Atlassian credentials, so I assess S:U, which lowers the realistic score to ~6.5. Net: a real data-exfiltration priority only for deployments where untrusted or multi-tenant clients share a privileged operator credential; low urgency for single-user local stdio deployments. No conflicting network-vs-local signal - the MCP server is network-callable but the file read is server-local. |
| Exploit ScenarioDerived | An attacker who can invoke the MCP server's tools calls confluence_upload_attachment with file_path pointing at a sensitive server-local file such as ~/.env, /etc/passwd, or a mounted Kubernetes secret. The server opens the file with open(file_path,'rb') without confining the resolved path to the workspace, uploads its contents as an attachment to a Confluence page, and the attacker retrieves the page through normal Atlassian access. No public POC is provided, but the fixing PR #1448 diff and GHSA-6cr4-ccf3-x7h4 fully disclose the vulnerable code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows an accepted MCP caller to read arbitrary files from the host on which the server runs: the confluence_upload_attachment tool opens a caller-supplied file_path after only converting it with os.path.abspath, with no check that the resolved path stays inside the workspace, and then uploads the contents as a Confluence attachment the caller can download back. The vulnerability is an access-gated, confused-deputy arbitrary-file-read (CWE-22, assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, high confidentiality impact, no integrity or availability impact); exploitation requires an authenticated MCP caller (PR:L), a server older than 0.22.0 configured with Confluence credentials that can write attachments, and a space the attacker can read back - single-user local stdio deployments where the caller already owns the host gain nothing. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in version 0.22.0.
RemediationAI
Vendor-released patch: upgrade mcp-atlassian to 0.22.0 (https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0), which is the version named in advisory GHSA-6cr4-ccf3-x7h4 and which contains the validate_safe_path() workspace-confinement fix introduced in PR #1448 / commit b041733473f95119dd539542a43c280737a8e460 - applying that commit directly is acceptable for pinned deployments that cannot take the release. If immediate upgrade is not possible, the effective compensating controls are: (1) run the MCP server under a dedicated least-privilege OS account or in a container whose filesystem view contains no credentials, environment files, or secrets and whose sensitive mounts are read-only or absent - this is the only control that fully neutralizes the arbitrary read, at the cost of requiring container/sandbox plumbing; (2) disable or remove the confluence_upload_attachment tool via the MCP client's tool allowlist/denylist if attachment uploads are not needed, accepting the loss of that workflow; (3) eliminate reliance on shared operator/global Atlassian credentials by moving to per-user authentication (which the upstream PR's spaces-filter and SSRF hardening also assume), trading simpler deployment for per-request credential management; and (4) restrict the Confluence credential to spaces the caller cannot read back, which breaks the exfiltration channel but also constrains legitimate publishing. Note that the 0.22.0 change set also fixes SSRF/redirect and DNS-rebinding issues and a caller-overridable spaces allowlist, so deploying only a partial workaround for the path-traversal issue leaves those related weaknesses in place.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MCP Atlassian is a Python Model Context Protocol server that exposes Atlassian Confluence and Jira operations (search, page retrieval, attachment upload/download) as tools to an LLM client, wrapping the Confluence REST API behind a ConfluenceClient session. The root cause is an input-validation gap in the path-handling logic of confluence_upload_attachment (src/mcp_atlassian/confluence/attachments.py): a caller-controlled file_path was normalized with os.path.abspath and then passed directly to open(file_path, "rb"), so relative traversal sequences (../../) or absolute paths resolve outside the intended workspace and the file bytes are exfiltrated via the attachment upload channel - path traversal / arbitrary file read, CWE-22. The vendor fix in commit b041733473f95119dd539542a43c280737a8e460 and PR #1448 replaces the abspath conversion with validate_safe_path(), which rejects traversal and absolute paths that escape the current working directory. The same PR bundles adjacent hardening that indicates the project's defensive scope: SSRF redirect validation and DNS-pinning adapters mounted on the Confluence session (closing a validate-then-reconnect TOCTOU against rebinding), a change forcing the configured CQL spaces allowlist to be ANDed rather than replaced by a caller-supplied spaces_filter, and a check refusing Jira attachment downloads into the working-directory root to prevent overwriting an importable module (GHSA-6vmq). The CPE cpe:2.3:a:sooperset:mcp-atlassian:*:*:*:*:*:*:*:* confirms all pre-0.22.0 releases of the package are in scope.
Know when Mcp Atlassian gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable tool call by a permitted caller (PR:L); arbitrary read yields C:H with no I/A impact; scope unchanged since the read stays within the MCP host trust boundary, unlike the vendor's S:C.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files, credentials, or other readable host data to a Confluence page and retrieve it through Atlassian. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Technical POC Analysis
CWE-22 (path traversal), tracked alongside CWE-552 in the advisory.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The MCP Atlassian integration server (sooperset/mcp-atlassian), which mediates AI-assistant access to Confluence and Jira, can be turned against its own host: an authenticated caller can direct it to read any file on the machine and retrieve the contents back as a downloadable Confluence attachment. Any team running a shared or multi-tenant instance older than 0.22.0 with Confluence credentials that permit attachment writes is exposed, whereas single-user local deployments where the operator already controls the host gain little additional risk. Leadership should treat this as a data-exposure and downstream-access problem, because the files most likely to be pulled - environment files, tokens, SSH keys, and application configuration - frequently unlock other internal systems and cloud environments.
No vendor-released patch identified at time of analysis; the advisory identifies mcp-atlassian 0.22.0 as the version that removes the vulnerable path handling, so upgrading to 0.22.0 or later is the primary remediation. Interim mitigations: run the MCP server as a dedicated unprivileged account on a host that holds no unrelated secrets; containerize it with a read-only root filesystem and mount only the intended workspace directory so arbitrary host paths are unreachable; operate a least-privilege Confluence service account with attachment-write rights limited to the minimum required spaces and no read access to sensitive spaces; restrict and authenticate which callers may invoke MCP tools (exploitation requires an authenticated MCP caller, PR:L per the CVSS vector); apply outbound network egress filtering so uploaded attachments cannot be pulled back to untrusted destinations; log and alert on confluence_upload_attachment calls with file paths outside the workspace; and monitor for no public exploit identified at time of analysis, while remaining alert to changes in exploitation status.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Mcp Atlassian
View allServer-side request forgery in MCP Atlassian (the Model Context Protocol server for Confluence and Jira) prior to 0.22.0
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 applies its ENABLED_TOOLS and TOOLSETS least-privilege filters onl
Path traversal in MCP Atlassian releases prior to 0.22.0 lets a caller of the confluence_upload_attachment MCP tool read
Unauthenticated arbitrary file read in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a remote network calle
Arbitrary local file read leading to data exfiltration affects sooperset's MCP Atlassian server (mcp-atlassian) prior to
Unauthenticated server-local file exfiltration in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a remote
Server-side request forgery in MCP Atlassian prior to 0.22.0 lets an attacker who controls or has already compromised th
MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 lets a low-privileged authenticated MCP caller write attacker-chos
Server-side request forgery in MCP Atlassian (sooperset/mcp-atlassian) before 0.22.0 allows a low-privileged authenticat
Arbitrary local file read in MCP Atlassian (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP caller who can re
Arbitrary server-local file read and exfiltration in MCP Atlassian (sooperset/mcp-atlassian) prior to 0.22.0 lets an aut
Path traversal in the MCP Atlassian server (mcp-atlassian) prior to 0.22.0 allows an authenticated MCP client to read fi
Exploit-DB