CVE-2026-77247

## Summary The Jira and Confluence attachment upload tools accept caller-controlled file path parameters and read those paths from the MCP server's local filesystem before uploading the file as an Atlassian attachment. In local `stdio` deployments, this can expose files readable by the user's MCP process. In documented HTTP/SSE or `streamable-http` deployments, the impact is higher: any MCP client that is allowed to invoke write/upload tools can cause the server process to read a server-local file and upload it to Jira or Confluence. This is not dependent on an AI prompt injection or model behavior. It can be triggered deterministically with a normal MCP tool call. ## Details The vulnerable behavior exists because upload tool arguments are treated as server-local filesystem paths. Relevant implementation points: - `mcp_atlassian.confluence.attachments.AttachmentsMixin.upload_attachment` - Accepts `file_path`. - Converts the supplied value to an absolute path when needed. - Checks existence with `os.path.exists`. - Passes the path into the attachment upload flow. - `mcp_atlassian.confluence.attachments.AttachmentsMixin._upload_attachment_direct` - Opens the supplied `file_path` with `open(file_path, "rb")`. - Sends the resulting file object as multipart form data to Confluence. - `mcp_atlassian.confluence.attachments.AttachmentsMixin.upload_attachments` - Iterates caller-supplied `file_paths`. - Calls `upload_attachment` for each path. - `mcp_atlassian.jira.attachments.AttachmentsMixin.upload_attachment` - Accepts `file_path`. - Converts the supplied value to an absolute path when needed. - Checks existence with `os.path.exists`. - Opens the file and uploads it as a Jira attachment. - `mcp_atlassian.jira.attachments.AttachmentsMixin.upload_attachments` - Iterates caller-supplied `file_paths`. - Calls `upload_attachment` for each path. - `mcp_atlassian.servers.jira.update_issue` - Accepts an `attachments` argument as a JSON ar