The mcp-atlassian package contains an arbitrary server-side file read vulnerability via its attachment upload tools. The client-supplied 'file_path' parameter is resolved and opened on the server filesystem without validation or containment, allowing remote clients to read any file accessible to the server process. The file content is then uploaded as an Atlassian attachment, enabling exfiltration of sensitive server files and credentials. This affects the Confluence and Jira upload attachment endpoints. The vulnerability is present in versions prior to 0.22.0. No patch links are provided, and the service is not cloud-hosted.

An attacker with access to the MCP tools can exfiltrate arbitrary files readable by the server process, including system files like /etc/passwd, environment variables containing API tokens, application configuration, and key material. This leads to high confidentiality impact by disclosing sensitive server-side data and credentials. The vulnerability does not affect integrity or availability directly but compromises the confidentiality of the server environment and potentially other tenants' data in multi-tenant deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to MCP tools to trusted clients only and avoid exposing the attachment upload functionality over remote transports. Monitor for any updates from the vendor regarding patches or temporary mitigations.