MCP Atlassian Path Traversal Leading to Server File and Credential Disclosure

Technical Analysis

The confluence_upload_attachment, confluence_upload_attachments, and jira_update_issue tools pass a client-controlled file_path/attachments parameter directly into upload_attachment functions without confining it to an approved workspace directory. In multi-user HTTP or SSE deployments, a client with write-tool access can supply absolute paths or path-traversal sequences (e.g., ../../ or /etc/...) that the server resolves and reads from its own filesystem, then uploads the contents to an Atlassian instance as an attachment. This crosses the trust boundary between MCP client and server, enabling disclosure of server-side files, environment variables holding Atlassian API tokens/credentials, or data belonging to another tenant sharing the same server instance. The attacker gains read access to arbitrary server files reachable by the server process and can exfiltrate secrets via a legitimate-looking Atlassian attachment upload, effectively turning a benign tool call into a data exfiltration primitive.

Affected Systems

mcp-atlassian; protocols: MCP

Detection Signatures

• Tool call arguments to confluence_upload_attachment, confluence_upload_attachments, or jira_update_issue containing absolute paths (e.g., starting with / or C:\) or traversal sequences (../, ..\)
• Server logs showing upload_attachment invoked with file_path resolving outside expected workspace directory
• Unexpected outbound attachment uploads to Confluence/Jira containing server config files, .env content, or credential-like strings
• Multi-tenant MCP server logs showing one tenant's session accessing files associated with another tenant's workspace

Remediation Steps

1. 1

   Upgrade mcp-atlassian

   Update to version 0.22.0 or later, which fixes the path confinement issue.

2. 2

   Restrict deployment mode

   Where possible, run mcp-atlassian in local single-user stdio mode rather than remote HTTP/SSE multi-user mode until patched, since stdio deployments do not cross the trust boundary.

3. 3

   Enforce workspace path validation

   If self-hosting or forking, add server-side canonicalization and allow-listing of file paths to ensure they resolve within an approved upload directory, rejecting absolute paths and traversal sequences.

4. 4

   Least-privilege credentials

   Run the MCP server process with minimal filesystem permissions and store Atlassian credentials outside the process environment where feasible (e.g., secrets manager with short-lived tokens) to limit exposure if file read occurs.

5. 5

   Tenant isolation

   In multi-user deployments, isolate per-tenant server processes or containers to prevent cross-tenant data exposure even if a path traversal bug exists.

6. 6

   Monitor and alert

   Add detection rules for tool invocations with anomalous file paths and audit attachment upload contents for sensitive data patterns.