A broad working directory could expose local service-readable files through the attachment tool. Entry and authority. A remote HTTP/SSE MCP deployment starts with a wide current working directory, sometimes filesystem root. Observed mechanism and consequence. The local-file validator accepts paths beneath CWD; an exposed upload tool may read sensitive…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian attachment uploads treated process CWD as the file boundary
A broad working directory could expose local service-readable files through the attachment tool.
Public disclosure: Nov 8, 2026
Scope
A remote HTTP/SSE MCP deployment starts with a wide current working directory, sometimes filesystem root. The local-file validator accepts paths beneath CWD; an exposed upload tool may read sensitive local files and attach them to Confluence. Version 0.24.1 constrains the allowed directory.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-QH7Q-JMC7-RC7J; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-QH7Q-JMC7-RC7J-01 · CLM-DB233-ATL-GHSA-QH7Q-JMC7-RC7J-02 · mcp-atlassian advisory GHSA-qh7q-jmc7-rc7j
At a glance
The affected process must itself be able to read the file; no field exfiltration is reported.
Limits and uncertaintyFull account
A broad working directory could expose local service-readable files through the attachment tool.
Entry and authority. A remote HTTP/SSE MCP deployment starts with a wide current working directory, sometimes filesystem root.
Observed mechanism and consequence. The local-file validator accepts paths beneath CWD; an exposed upload tool may read sensitive local files and attach them to Confluence. Version 0.24.1 constrains the allowed directory.
Limits and status. The affected process must itself be able to read the file; no field exfiltration is reported.
The upload tool checked that a requested file lay under the process's current working directory. In service-manager configurations where that directory was the filesystem root, the guard could permit any service-readable path, including process environment files. The tool then made that file an Atlassian attachment. The disclosure establishes this conditional path traversal, not actual theft from deployed customer servers.
Mechanism and trust boundary
- 01
Precondition and trust context
A remote HTTP/SSE MCP deployment starts with a wide current working directory, sometimes filesystem root.
- 02
Crossed boundary
The local-file validator accepts paths beneath CWD; an exposed upload tool may read sensitive local files and attach them to Confluence. Version 0.24.1 constrains the allowed directory.
- 03
Observed limit
The affected process must itself be able to read the file; no field exfiltration is reported.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian attachment uploads treated process CWD as the file boundary
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-QH7Q-JMC7-RC7J-01The GHSA-qh7q-jmc7-rc7j advisory documents that the local-file validator accepts paths beneath CWD; an exposed upload tool may read sensitive local files and attach them to Confluence. Version 0.24.1 constrains the allowed directory.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-qh7q-jmc7-rc7jprimary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-QH7Q-JMC7-RC7J-02The disclosed precondition is: A remote HTTP/SSE MCP deployment starts with a wide current working directory, sometimes filesystem root.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-qh7q-jmc7-rc7jprimary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Use a dedicated upload directory that is never `/` or the whole home directory; 0.24.1 introduces MCP_ATLASSIAN_FILES_DIR and a narrow default.
- Prevent agent-controlled paths from reaching host secrets and grant the service process only minimal filesystem read permission.
Unknowns and contradictions
- The affected process must itself be able to read the file; no field exfiltration is reported.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235