MCP Atlassian Path Traversal Leading to Arbitrary File Read and Credential Exfiltration

Technical Analysis

The vulnerability lies in _upload_attachment_direct() within src/mcp_atlassian/confluence/attachments.py, where a client-supplied file_path is passed directly to open(file_path, 'rb') without invoking validate_safe_path(), enabling classic path traversal (e.g., ../../ sequences or absolute paths) to escape any intended attachment directory. The entry point is the confluence_upload_attachment MCP tool call, reachable either directly by an authenticated MCP client or indirectly by an AI agent that is prompt-injected via untrusted document/ticket content instructing it to upload a sensitive file (such as /proc/self/environ or a .env file) as an attachment. The attacker gains read access to any file accessible to the server process, and by uploading it to Confluence, the exfiltration channel bypasses normal network egress controls since it rides on the legitimate Confluence API session. This crosses the tool-to-host boundary: an MCP tool meant only to manipulate wiki content is repurposed into an arbitrary file disclosure primitive, and crosses the agent-to-server trust boundary since an LLM agent's tool call is treated as fully authorized by the server.

Affected Systems

MCP Atlassian; protocols: MCP

Detection Signatures

• confluence_upload_attachment calls with file_path containing '../', absolute paths (e.g., '/etc/', '/proc/', '/home/'), or unexpected directory traversal sequences
• Server logs showing open() calls outside expected attachment staging directories
• Unusual attachments appearing on Confluence pages with filenames resembling system files (.env, environ, credentials, config)
• MCP tool invocation patterns where file_path argument value did not originate from an internal upload workflow but from LLM-generated or externally-sourced content

Remediation Steps

1. 1

   Upgrade MCP Atlassian

   Update to version 0.22.0 or later, which restores validate_safe_path() enforcement on confluence_upload_attachment.

2. 2

   Enforce path canonicalization and allow-listing

   Ensure all file_path inputs to upload tools are canonicalized and checked against an explicit allow-listed base directory before any open() call.

3. 3

   Restrict credential exposure to server process

   Avoid storing API tokens (e.g., CONFLUENCE_API_TOKEN) as plaintext environment variables readable by the process; use a secrets manager or restricted-permission credential files.

4. 4

   Sandbox and least-privilege MCP server deployment

   Run the MCP Atlassian server with a minimal filesystem view (container, chroot, or restricted user) so arbitrary file reads cannot reach sensitive host files.

5. 5

   Validate tool inputs from agent-generated content

   Add guardrails so that AI agents cannot pass externally-influenced or untrusted content directly as tool arguments like file_path without human or policy review.