The mcp-atlassian package's confluence_upload_attachment function lacks path validation on the file_path parameter before opening the file. This allows any authenticated MCP client or an AI agent influenced by prompt injection to read arbitrary files that the server process can access and upload them as Confluence attachments. The root cause is the absence of a validate_safe_path call before open(file_path, "rb"). The vulnerability has been confirmed with proof-of-concept uploads of sensitive files including /proc/self/environ, which contains environment variables with secrets like API tokens and credentials. Exploitation via prompt injection requires no MCP authentication, as demonstrated by an AI agent autonomously executing the upload based on crafted input. The vulnerability affects mcp-atlassian versions before 0.22.0.

Successful exploitation allows reading and exfiltration of any file accessible by the server process, including sensitive environment variables containing API tokens, AWS keys, and database credentials. This can lead to full Atlassian account takeover and lateral movement within connected systems. The vulnerability can be triggered without authentication via prompt injection against AI agents using the MCP client, significantly increasing the attack surface and risk.

A fix is available in mcp-atlassian version 0.22.0 and later that adds path validation before opening files in the confluence_upload_attachment function. Users should upgrade to version 0.22.0 or later to remediate this vulnerability. Until upgraded, restrict access to MCP clients and carefully control AI agent inputs to prevent prompt injection attacks. Patch status is confirmed by the existence of the fix in version 0.22.0.