CVE-2026-77266

### Summary The `upload_attachment` functions in both the Jira and Confluence modules accept a user-controlled `file_path` parameter and open the specified file for reading **without calling `validate_safe_path()`**. An authenticated MCP client can supply an arbitrary path such as `/etc/passwd` or `/proc/self/environ`, causing the server process to read and transmit the file's contents to the remote Atlassian instance as an attachment. This is an **incomplete fix** relative to GHSA-xjgw-4wvw-rgm4: the `download_attachment` and `download_issue_attachments` paths were hardened with `validate_safe_path()`, but the upload direction was left unguarded in both the Jira and Confluence modules. --- ### Details **Affected functions:** | File | Function | Line | |------|----------|------| | `src/mcp_atlassian/jira/attachments.py` | `upload_attachment()` | ~372–415 | | `src/mcp_atlassian/confluence/attachments.py` | `upload_attachment()` | ~62–108 | | `src/mcp_atlassian/confluence/attachments.py` | `_upload_attachment_direct()` | ~476–477 | **Jira — vulnerable code path (`jira/attachments.py`):** ```python def upload_attachment(self, issue_key: str, file_path: str) -> dict: ... if not os.path.isabs(file_path): file_path = os.path.abspath(file_path) # resolves relative paths if not os.path.exists(file_path): # confirms file exists ... # ⚠ validate_safe_path() is NEVER called here filename = os.path.basename(file_path) with open(file_path, "rb") as file: # arbitrary file opened attachment = self.jira.add_attachment( issue_key=issue_key, filename=file_path ) ``` Compare with the **protected** download path in the same file: ```python def download_attachment(self, url: str, target_path: str) -> bool: ... validate_safe_path(target_path) # upload has no equivalent ``` **Confluence — vulnerable code path (`confluence/attachments.py`):** ```python def upload_attachmen