CVE-2026-77253

### Summary MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the MCP process and send it to Jira/Confluence as an attachment. ### Details The Confluence MCP upload tool accepts a `file_path` described as an absolute or relative server path in `src/mcp_atlassian/servers/confluence.py:1290-1316` and forwards it directly to `confluence_fetcher.upload_attachment()` in `src/mcp_atlassian/servers/confluence.py:1356-1363`. The multi-upload variant accepts comma-separated local paths in `src/mcp_atlassian/servers/confluence.py:1372-1449`. The Confluence attachment implementation converts relative paths to absolute paths, checks only existence, and then opens the path for upload. There is no call to `validate_safe_path()` or any allowed directory check for uploads in `src/mcp_atlassian/confluence/attachments.py:61-79`; the direct upload path opens the file with `open(file_path, "rb")` in `src/mcp_atlassian/confluence/attachments.py:467-490`. The Jira upload implementation has the same pattern: it converts relative paths, checks existence, and opens the path in `src/mcp_atlassian/jira/attachments.py:371-388`. Jira issue update also accepts an `attachments` field as JSON or CSV local paths in `src/mcp_atlassian/servers/jira.py:1609-1662`, forwards it through update fields in `src/mcp_atlassian/servers/jira.py:1668-1676`, and `IssuesMixin.update_issue()` calls `self.upload_attachments(issue_key, kwargs["attachments"])` in `src/mcp_atlassian/jira/issues.py:1132-1137`. The tools are decorated with `@check_write_access`, so `READ_ONLY_MODE=true` blocks them. However, in default write-enabled deployments, the only security boundary is whether the MCP caller can invoke write tools. Combined with HTTP/multi-user exposure, this becomes a server-sid