MCP Atlassian, a Model Context Protocol server used with Atlassian Confluence and Jira, contains a flaw in the confluence_upload_attachment endpoint. Prior to version 0.22.0 the endpoint opens a caller‑selected file from the local server filesystem without ensuring that the resolved path remains within the workspace. As a result, an authenticated user able to upload an attachment can specify a path to any readable server file, causing the server to stream that file back to the user through Atlassian. This enables exfiltration of sensitive host data such as environment files, credentials, or other confidential configuration information, representing a direct breach of confidentiality. Affected systems include the MCP Atlassian product by sooperset, deployed with Confluence or Jira, in any release prior to 0.22.0. Any installation that exposes the confluence_upload_attachment route to users, especially those with file upload permissions, is susceptible. The vulnerability is scored as CVSS 7.7, indicating a high severity but without a publicly available EPSS score or KEV listing. The likely attack vector is an authenticated user who can upload attachments in Confluence. The required conditions are minimal: the ability to invoke the upload endpoint and specify an arbitrary file path, with no complex preparation or exploitation code. Given its high impact and the absence of mitigations in older releases, the risk remains significant until a patch is applied.

MCP Atlassian from sooperset is the affected product. All deployments of the server that include the confluence_upload_attachment endpoint and run a version earlier than 0.22.0 are vulnerable. The flaw is present in installations that integrate MCP with Atlassian Confluence or Jira, and is triggered when users with file‑upload privileges call the upload route. Any such instance that exposes this endpoint is at risk.

The CVSS score of 7.7 classifies the flaw as high severity, indicating a substantial impact on confidentiality. EPSS data is not available, so the exploit probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely an authenticated user with permission to upload files to Confluence pages; no additional compromise or privilege escalation is required. The attacker can simply supply an arbitrary server file path during upload, causing the service to return the file’s contents. Due to the minimal prerequisites and the direct exfiltration capability, the risk remains significant for all affected installations.