What happened
MCP Atlassian, a Model Context Protocol server for Confluence and Jira, passes a client-supplied file_path directly to open(file_path, 'rb') in confluence_upload_attachment (via _upload_attachment_direct()) without sanitization prior to version 0.22.0 (CVE-2026-73498, CVSS 7.7, High).
Why it matters
mcp-atlassian is a widely-used MCP server connecting LLM agents to Confluence/Jira; a path traversal in the attachment-upload tool call lets an AI agent (or an attacker who can influence its tool arguments) read arbitrary files from the host filesystem via a normal-looking MCP tool invocation.
Attack vector
An LLM agent (or attacker manipulating agent tool-call arguments via prompt injection) supplies a crafted file_path to the confluence_upload_attachment MCP tool, causing the server to open and expose arbitrary host files
Affected systems
mcp-atlassian < 0.22.0
Mitigation
Upgrade to mcp-atlassian 0.22.0 or later