Evidence · DiggingBeagle record
mcp-atlassian advisory GHSA-qh7q-jmc7-rc7j
Original mcp-atlassian security advisory for mcp atlassian attachment uploads treated process cwd as the file boundary.
- Published
- Nov 8, 2026
- Source role
- primary disclosure
Evidence record
Original mcp-atlassian security advisory for mcp atlassian attachment uploads treated process cwd as the file boundary.
Claim-level citations (2)
- supportsMCP Atlassian attachment uploads treated process CWD as the file boundary: The GHSA-qh7q-jmc7-rc7j advisory documents that the local-file validator accepts paths beneath CWD; an exposed upload tool may read sensitive local files and attach them to Confluence. Version 0.24.1 constrains the allowed directory.
Advisory: Summary and Details
- supportsMCP Atlassian attachment uploads treated process CWD as the file boundary: The disclosed precondition is: A remote HTTP/SSE MCP deployment starts with a wide current working directory, sometimes filesystem root.
Advisory: Affected configurations and reproduction