CVE-2026-82233: SiYuan before v3.8.1 Path Traversal via asset.upload

Q: Who is exposed to this issue?

SiYuan deployments running a version before 3.8.1 that make the AI Agent's asset.upload MCP tool available are exposed. The issue affects uploads where the tool can be directed to read files outside the workspace.

Q: What does an attacker need to exploit it?

An attacker needs to induce the AI Agent to invoke asset.upload with an arbitrary absolute path, such as through prompt injection. The vulnerability can then cause sensitive local files, including SSH keys or credentials, to be copied into the asset directory.

Q: What should be done to remediate the issue?

Upgrade SiYuan to version 3.8.1 or later. The vulnerable behavior is present in versions before 3.8.1.

Published Aug 28, 2026

Updated

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.

Affected Software

1 affected component

SiYuan SiYuan<3.8.1

Event History

Aug 28, 2026

CVE Published

via MITRE·10:49 AM

Data Sourced

via MITRE·10:49 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

SiYuan deployments running a version before 3.8.1 that make the AI Agent's asset.upload MCP tool available are exposed. The issue affects uploads where the tool can be directed to read files outside the workspace.

What does an attacker need to exploit it?

An attacker needs to induce the AI Agent to invoke asset.upload with an arbitrary absolute path, such as through prompt injection. The vulnerability can then cause sensitive local files, including SSH keys or credentials, to be copied into the asset directory.

What should be done to remediate the issue?