CVE-2026-60083: SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool
SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.8.0 - Compensating control
Until upgrading, restrict access to SiYuan’s HTTP API (and MCP file tool usage) so that authenticated administrators cannot leverage the MCP file tool to read sensitive workspace files such as data/templates and data/snippets/conf.json.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SiYuan administrator can exploit the MCP file tool to read files that the HTTP API is intended to protect. The issue is network-accessible and does not require user interaction.
What sensitive information may be exposed?
Affected instances may expose plaintext publish-mode passwords from data/.siyuan/publishAccess.json. Other sensitive workspace content, including data/templates and data/snippets/conf.json, may also be accessible.
Which versions are affected?
SiYuan versions before v3.8.0 are affected. Upgrading to v3.8.0 or later addresses the incomplete path blocklist described for the MCP file tool.