Weak attachment-download destination validation permits a controlled local-file overwrite. Entry and authority. A Confluence attachment can be fetched into a directory adjacent to importable Python files. Observed mechanism and consequence. An attacker-selected download path bypassed the existing Jira-side guard; a test import executed a harmless…
Inspect the ClaimsCase · DiggingBeagle record
MCP Atlassian Confluence downloads could overwrite executable module paths
Weak attachment-download destination validation permits a controlled local-file overwrite.
Public disclosure: Nov 8, 2026
Scope
A Confluence attachment can be fetched into a directory adjacent to importable Python files. An attacker-selected download path bypassed the existing Jira-side guard; a test import executed a harmless overwritten-module marker. Version 0.24.1 adds confinement.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GHSA-823G-2JMV-9GMC; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ATL-GHSA-823G-2JMV-9GMC-01 · CLM-DB233-ATL-GHSA-823G-2JMV-9GMC-02 · mcp-atlassian advisory GHSA-823g-2jmv-9gmc
At a glance
Demonstrated at a lower-level fetch API; standard MCP-tool remote execution was not established.
Limits and uncertaintyFull account
Weak attachment-download destination validation permits a controlled local-file overwrite.
Entry and authority. A Confluence attachment can be fetched into a directory adjacent to importable Python files.
Observed mechanism and consequence. An attacker-selected download path bypassed the existing Jira-side guard; a test import executed a harmless overwritten-module marker. Version 0.24.1 adds confinement.
Limits and status. Demonstrated at a lower-level fetch API; standard MCP-tool remote execution was not established.
The Confluence download helper did not share an earlier Jira-specific path hardening. With a permissive working-directory root, an attacker-influenced attachment destination could overwrite a local module later imported by the tool process. The reported import marker demonstrates an overwrite-to-execution path in a controlled scenario, but not that a regular remote MCP call automatically achieves code execution in every deployment.
Mechanism and trust boundary
- 01
Precondition and trust context
A Confluence attachment can be fetched into a directory adjacent to importable Python files.
- 02
Crossed boundary
An attacker-selected download path bypassed the existing Jira-side guard; a test import executed a harmless overwritten-module marker. Version 0.24.1 adds confinement.
- 03
Observed limit
Demonstrated at a lower-level fetch API; standard MCP-tool remote execution was not established.
Timeline
- Nov 8, 2026Event type unspecified
Initial documented finding
MCP Atlassian Confluence downloads could overwrite executable module paths
- Nov 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ATL-GHSA-823G-2JMV-9GMC-01The GHSA-823g-2jmv-9gmc advisory documents that an attacker-selected download path bypassed the existing Jira-side guard; a test import executed a harmless overwritten-module marker. Version 0.24.1 adds confinement.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-823g-2jmv-9gmcprimary disclosure
Advisory: Summary and Details
CLM-DB233-ATL-GHSA-823G-2JMV-9GMC-02The disclosed precondition is: A Confluence attachment can be fetched into a directory adjacent to importable Python files.supported
Basis: reported finding
- supportsmcp-atlassian advisory GHSA-823g-2jmv-9gmcprimary disclosure
Advisory: Affected configurations and reproduction
Controls and mitigations
- Confine attachment destinations to a dedicated non-executable directory and reject traversal, symlink escapes and module paths; use the 0.24.1 fix.
- Separate the process's code installation paths from writable artifact directories and prevent import-time execution from downloaded files.
Unknowns and contradictions
- Demonstrated at a lower-level fetch API; standard MCP-tool remote execution was not established.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235