# MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

mcp-atlassian's confluence_upload_attachment opened caller-supplied file_path without validation, letting any MCP client read server files and exfiltrate them as Confluence attachments.

- Payout: Research
- Severity: high
- Program: mcp-atlassian
- Found by: rushitgit
- Disclosed: 2026-09-22
- CVE: CVE-2026-77259
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-6cr4-ccf3-x7h4
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-6cr4-ccf3-x7h4
- Tags: area:ai domain:ai impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:llm tech:python technique:incomplete-fix vuln:info-disclosure vuln:path-traversal vuln:secrets-leak

**Target:** MCP server tool confluence_upload_attachment (Python package)
**Root cause:** AttachmentsMixin.upload_attachment() passes the caller-supplied file_path directly to open() with no boundary check; the validate_safe_path() hardening applied to the download path in GHSA-xjgw-4wvw-rgm4 was never applied to upload.
**Steps:**
1. Copy a sensitive file to a readable path, e.g. `cp ~/.aws/credentials /tmp/diagram.png` (on Linux target `/proc/self/environ` directly).
2. Invoke the MCP tool: `confluence_upload_attachment(content_id="<page attacker can edit>", file_path="/tmp/diagram.png")`.
3. Download the resulting attachment from Confluence; it contains the raw file contents.
**How found:** Noticed the download path had been hardened with validate_safe_path() in a prior advisory (GHSA-xjgw-4wvw-rgm4) while the upload path in the same module still called open(file_path) unguarded — an incomplete-fix pattern; verified against live Confluence Cloud on 0.21.1.
**Exploitation:** Any authenticated MCP client with edit access to one Confluence page calls the upload tool with an arbitrary absolute path; the server opens the file and uploads its bytes as an attachment to the attacker-controlled page, which the attacker then downloads. On shared/Docker deployments /proc/self/environ yields all users' API tokens in one call; exfiltrated Atlassian tokens give persistent API access surviving server shutdown or patching.
**Escalation:** Single request on Linux via /proc/self/environ harvests all runtime secrets for every user on a shared deployment; stolen Atlassian tokens outlive the MCP server.
**Insight:** When an advisory fixes a path-handling bug in one direction (download/read), audit the sibling direction (upload/write) in the same mixin and the Jira equivalent — fixes are rarely applied symmetrically. On Linux, /proc/self/environ turns any arbitrary-file-read into a full secret dump in one request.