The vulnerability arises from an unconstrained file_path parameter in the MCP upload_attachment endpoint used by Confluence and Jira. A permitted MCP caller can specify any local file path, and the server opens and reads that file without validating the path. The attacker can therefore retrieve sensitive system files such as configuration files, passwords, or other confidential data that reside on the host machine. This results in a confidentiality breach and may allow the attacker to gain further insight into the system or use the information for escalation.

The impacted product is the MCP Atlassian server, a Model Context Protocol implementation for Atlassian Confluence and Jira produced by Sooperset. Versions prior to 0.22.0 contain the flaw. The bug is fixed in release 0.22.0, and all newer versions should be considered secure.

The CVSS score of 8.3 indicates a high severity vulnerability. EPSS data is not available, so the likelihood of exploitation is uncertain but could be high if an attacker can obtain an authorized MCP client. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to involve a permitted MCP caller sending a crafted file_path string; the server unconditionally opens the file, enabling local file disclosure. The flaw does not allow arbitrary code execution or remote code execution but does expose sensitive data, posing a significant risk especially in environments where MCP clients are trusted but potentially compromised.