MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)
Published Sep 22, 2026 · Updated Nov 3, 2026
Original summary
Normalized public record · Updated Nov 3, 2026
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
The confluenceuploadattachment and confluenceuploadattachments MCP tools accept a filepath parameter and do not validate that the path is confined to an allowed directory before opening the file. An attacker who can call these tools can read any file accessible to the MCP server process (SSH keys, .env files, API credentials) and exfiltrate it by uploading it to Confluence. Note: The Jira uploadattachment mixin method in jira/attachments.py has the same missing validation, but it is NOT registered as an MCP tool in servers/jira.py and is therefore not currently reachable via MCP. It should still be patched to prevent future exposure if Jira upload tools are added. This is an incomplete fix for CVE-2026-27825. That CVE was patched by adding validatesafepath() to download operations (v0.17.0). The same protection was not applied to upload operations.
Potential impact
Arbitrary file read from the server filesystem. High-value targets: SSH private keys, .env files, AWS/GCP credentials, database configuration, source code.
Technical context
validatesafepath() is imported in both confluence/attachments.py and jira/attachments.py and is correctly called in all download functions. It is absent from the Confluence upload functions (which are exposed as MCP tools) and from the Jira upload mixin methods (which are not currently registered as MCP tools but should still be patched). Download (protected — correctly patched): Upload (vulnerable — not patched): Same pattern in jira/attachments.py:386.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- LOW
- Confidence
- Not available
- Aliases
- None reported
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
Record history
Published Sep 22, 2026 · Last refreshed Nov 3, 2026