Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100633SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations
Medium 6.5
In plain English
A medium-severity incorrect authorization in siyuan from siyuan-note. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPath(), invoked from resolvePath()) is applied only to the allowed root of recursive operations and not to each resolved descendant path — an incomplete fix for GHSA-c8r8-95hg-mp34. An authenticated administrator using the in-app Agent or the external MCP server can therefore bypass the protected-workspace-file denylist: file.grep can return matching lines from non-hidden protected descendants (for example conf/conf.json, TLS keys, data/snippets/conf.json, data/templates/, data/.siyuan/publishAccess.json, notebook .siyuan internals, or the kernel log), file.copy can copy protected descendants to an ordinary path where file.read can then retrieve them, and unzip can overwrite protected descendants using ordinary, lexically contained ZIP member names. Because file.grep is globally classified as a safe action, it receives no per-call confirmation, and the confirmation cards for file.copy and unzip show only the allowed root arguments. This issue is fixed in version 3.8.4. Suggested title: SiYuan 3.8.0 through 3.8.3 Sensitive-Path Guard Bypass in Recursive MCP File Operations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | 3.8.0 – before 3.8.4 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
- GitHub Security Advisory (GHSA-9g6v-r3xf-673q) vendor-advisory
- VulnCheck Advisory: SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations third-party-advisory