The flaw originates from a missing path validation in the confluence_upload_attachment endpoint. An attacker who can authenticate to the MCP server can supply a file_path that points to any file the server process can access, after which the file is read and returned as an attachment, allowing exfiltration. This allows disclosure of sensitive data such as configuration files, environment variables, or credentials. The impact is a confidentiality breach, with no denial of service or privilege escalation noted.

The vulnerable product is Sooperset’s mcp‑atlassian server. Every release before v0.22.0 is affected; the flaw resides in src/mcp_atlassian/confluence/attachments.py where the client‑supplied file_path is passed directly to open() without safe‑path validation.

The CVSS score of 7.7 denotes high severity. EPSS is not available, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting no widespread public exploitation yet. Successful exploitation requires an authenticated MCP client that can provide arbitrary file paths. Once authenticated, the attack path is trivial because the server blindly reads the requested file and uploads it to Confluence, so the risk remains high in environments that expose the upload_attachment endpoint without additional controls.