title: Attachment/Upload Tool Argument Reads Sensitive System File or Traverses Outside Workspace
id: ATR-2026-02250
rule_version: 1
status: experimental
description: |
  Detects an attachment-upload or file-attach style tool call whose file path argument targets a sensitive system location (/proc/self/environ, /etc/passwd or /etc/shadow, ~/.ssh/*) or uses relative path traversal (../) rather than referencing an ordinary user-owned file. The upload tool becomes an exfiltration channel: the server reads whatever path it is given and sends the bytes to an external destination (Confluence, Jira, or similar) as an attachment, so the read is invisible to the caller as a raw file read and shows up only as a normal-looking upload API call. Mined from GHSA-g5r6-gv6m-f5jv and GHSA-wm45-qh3g-v83f (mcp-atlassian's confluence_upload_attachment / jira_update_issue attachments parameter pass file_path directly to open() with no path validation, confirmed exploitable via /etc/passwd, /proc/self/environ, and relative traversal, including via prompt injection with no direct MCP access). Generalized beyond those two tool names to any upload/attach-style tool argument carrying the same shape. This is complementary to ATR-2026-00113 (credential file theft), which already covers ~/.ssh/id_rsa and /etc/passwd in most phrasings but misses /proc/self/environ and relative-traversal attachment-argument forms.
author: ATR Community (CVE sweep)
date: 2026/07/11
schema_version: '0.1'
detection_tier: pattern
maturity: experimental
severity: high
references:
  cve:
    - CVE-2026-58499
  cwe:
    - CWE-22
    - CWE-73
  owasp_llm:
    - LLM02:2025
  owasp_agentic:
    - ASI01:2026
  mitre_attack:
    - T1005 - Data from Local System
  mitre_atlas:
    - AML.T0057 - LLM Data Leakage
  external:
    - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g5r6-gv6m-f5jv
    - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-wm45-qh3g-v83f
metadata_provenance:
  cve: human-reviewed
  cwe: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  mitre_attack: human-reviewed
  mitre_atlas: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires resistance to unauthorised data access; this rule detects an attachment-upload tool argument being weaponised to read and exfiltrate sensitive host files via a channel that does not look like a raw file read.
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control for the upload-tool-as-exfiltration-channel risk class.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MG.2.3
      context: Treating upload-tool arbitrary file reads as an identified AI risk requires active runtime countermeasures; this detection rule is the primary risk treatment implementation.
      strength: primary
    - subcategory: MP.5.1
      context: Identifying the upload-tool exfiltration-channel pattern as an AI risk to be catalogued in the organizational risk register.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by this rule's detection of attachment-upload-tool arbitrary file reads.
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented via this rule's runtime detection of the exfiltration attempt.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: upload-tool-arbitrary-file-read
  scan_target: llm_io
  confidence: high
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  conditions:
    - field: content
      operator: regex
      value: (?i)\b(file_path|filepath|attachments?)\b\s*[=:]\s*["\x27]?(?:/proc/self/environ|/etc/(?:passwd|shadow)\b|~?/\.ssh/[\w.-]*(?:id_[rd]sa|id_ed25519|authorized_keys))
      description: Attachment/file-path tool argument targeting /proc/self/environ, /etc/passwd|shadow, or an SSH key -- always suspicious regardless of surrounding verb
    - field: content
      operator: regex
      value: (?i)\battachments?\b\s*[=:]\s*["\x27]?(?:\.\./){2,}
      description: '''attachments'' argument begins with 2+ levels of relative traversal -- a single ../ to a sibling project directory is too weak a signal on its own, but 2+ levels escaping toward a system root is not a normal same-project reference'
    - field: content
      operator: regex
      value: (?i)\b(upload|attach)\w*\b[\s\S]{0,30}\b(file_path|filepath)\b\s*[=:]\s*["\x27]?(?:\.\./){2,}
      description: Upload/attach-style tool call whose file_path argument begins with 2+ levels of relative traversal (verb-gated so an unrelated shell 'export FILE_PATH=../...' does not fire)
  false_positives:
    - An upload/attach tool call referencing an ordinary user-owned file by absolute or relative path with no traversal and no system-sensitive target (e.g. file_path=/home/user/report.pdf, file_path=./invoice.pdf)
    - A single ../ reference to a sibling directory in the same project (e.g. attachments=../shared/logo.png) -- only 2+ levels of traversal fire, since escaping one sibling directory is a normal same-project reference and not evidence of reaching a system path
    - Documentation or tutorials that show the vulnerable code pattern as an example without an actual tool-call argument being set
response:
  actions:
    - block_input
    - alert
  message_template: |
    [ATR-2026-02250] Attachment/upload tool argument targets a sensitive system file or uses path traversal -- treat as an arbitrary file read exfiltration attempt, not a normal attachment upload.
confidence: 80