CVE-2026-100633: SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations
SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPath(), invoked from resolvePath()) is applied only to the allowed root of recursive operations and not to each resolved descendant path — an incomplete fix for GHSA-c8r8-95hg-mp34. An authenticated administrator using the in-app Agent or the external MCP server can therefore bypass the protected-workspace-file denylist: file.grep can return matching lines from non-hidden protected descendants (for example conf/conf.json, TLS keys, data/snippets/conf.json, data/templates/, data/.siyuan/publishAccess.json, notebook .siyuan internals, or the kernel log), file.copy can copy protected descendants to an ordinary path where file.read can then retrieve them, and unzip can overwrite protected descendants using ordinary, lexically contained ZIP member names. Because file.grep is globally classified as a safe action, it receives no per-call confirmation, and the confirmation cards for file.copy and unzip show only the allowed root arguments. This issue is fixed in version 3.8.4. Suggested title: SiYuan 3.8.0 through 3.8.3 Sensitive-Path Guard Bypass in Recursive MCP File Operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SiYuan administrator can exploit it through the in-app Agent or an external MCP server. The affected functionality is MCP file operations.
Does exploitation require user confirmation?
Not for file.grep, which is globally classified as a safe action and receives no per-call confirmation. file.copy and unzip display confirmation cards, but those cards show only allowed root arguments rather than the protected descendant paths involved.
What can an attacker do with the bypass?
They can use file.grep to retrieve matching content from non-hidden protected descendants, copy protected files to an ordinary location and read them, or use unzip to overwrite protected descendants. Examples include configuration files, TLS keys, notebook internals, templates, snippets, publish-access settings, and kernel logs.
Which versions are affected and what fixes the issue?
SiYuan versions 3.8.0 through 3.8.3 are affected. The issue is fixed in version 3.8.4.