{"id":"CVE-2026-60083","aliases":["EUVD-2026-64268","GHSA-c8r8-95hg-mp34","GHSA-rp7c-4prv-9rrg","GO-2026-6863"],"status":"published","title":"SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool","description":"SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00391,"percentile":0.33548,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-08-22T12:26:36Z","modified":"2026-11-05T23:25:40Z","fixes":[{"ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","fixed_in":["0.0.0-20260808051406-3542530c505f"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20260808051406-3542530c505f"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260808051406-3542530c505f"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260808051406-3542530c505f"}]}]}],"products":[{"vendor":"siyuan-note","product":"siyuan"}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34","tags":["vendor-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool","tags":["third-party-advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60083","tags":["advisory"]},{"url":"https://github.com/siyuan-note/siyuan/commit/3542530c505f13aa3fbd0343627409ca6c000dd2","tags":["web"]},{"url":"https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c8r8-95hg-mp34"},{"url":"https://github.com/advisories/GHSA-rp7c-4prv-9rrg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60083.json","tags":["advisory"]},{"url":"https://github.com/siyuan-note/siyuan","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-60083","title":"SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool","description":"SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.","status":"published","published":"2026-08-22T12:26:36.709Z","modified":"2026-08-24T18:41:00.99Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:49:20.39253Z"}],"euvd":[{"id":"EUVD-2026-64268","description":"SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.","status":"published","published":"2026-08-22T12:26:36Z","modified":"2026-08-24T18:41:00Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:34.230875Z"}],"ghsa":[{"id":"GHSA-c8r8-95hg-mp34","title":"SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files","description":"## Summary\n\n`kernel/mcp/tools/file.go`'s `resolvePath()` includes an explicit comment stating its\nsensitive-path blocklist is meant to align with the HTTP file API's established blacklist\n(`refuseToAccess()` in `kernel/api/file.go`), following the remediation for GHSA-cvhv-7xhj-xjp8\n(\"Unauthenticated Administrator takeover exfiltrated via the MCP\"), which specifically\nrecommended restricting this tool's scope. In practice, the MCP tool implements only 1 of the\n4 static blocklist entries the HTTP API enforces.\n\n## Comparison\n\n`kernel/api/file.go` `refuseToAccess()` blocks:\n1. `conf/conf.json` (API token, cookie signing key, accessAuthCode)\n2. `data/snippets/conf.json`\n3. the entire `data/templates` directory\n4. `data/.siyuan/publishAccess.json`\n5. (dynamic, per-request) any path the current publish-mode session isn't authorized for\n\n`kernel/mcp/tools/file.go` `resolvePath()` blocks only:\n```go\nconfPath := filepath.Join(util.ConfDir, \"conf.json\")\nif abs == confPath {\n    return \"\", fmt.Errorf(\"access to conf.json is forbidden\")\n}\n```\nItems 2, 3, and 4 are absent. The tool's own `list`/`read`/`grep`/`find` actions remain fully\nfunctional against them.\n\n## Impact\n\nAn MCP client with access to the `file` tool (post-fix for GHSA-cvhv-7xhj-xjp8, i.e. a properly\nauthenticated Administrator-level caller) can read `data/.siyuan/publishAccess.json` directly:\n\n```go\ntype PublishAccessItem struct {\n    ID       string `json:\"id\"`\n    Visible  bool   `json:\"visible\"`\n    Password string `json:\"password\"` // plaintext; empty string = no password\n    Disable  bool   `json:\"disable\"`\n}\n```\n\nThis exposes the plaintext access password for every publish-mode-shared notebook/document,\nletting the reader bypass password protection on any publish-mode share. This is a serious\nsibling issue given the volume of publish-mode access-control bugs already reported against this\ncodebase — the passwords protecting exactly that feature are directly readable through a tool\nwhose own description says \"never use for workspace data.\"\n\n`data/templates` and `data/snippets/conf.json` are lower-severity but still inconsistent with\nthe HTTP API's own precedent for what counts as sensitive.\n\n## Why this is a distinct finding, not a duplicate\n\nGHSA-cvhv-7xhj-xjp8 was about *reachability* an unauthenticated Reader-tier JWT being forwarded\nto admin-scoped paths including `/mcp`. That has been fixed. This report is about the *tool's own\nscope* once reached by a legitimate, properly-authenticated caller, the remediation notes for\nthat same advisory explicitly called for restricting `resolvePath` to\n`WorkspaceDir/temp/siyuan/*.log`, which was not implemented; instead the tool retains\nworkspace-wide scope with only a single-file blocklist addition.\n\n## Suggested fix\n\nEither replicate the full `refuseToAccess()` blocklist in `resolvePath()` (minimum fix, keeps\nparity with the HTTP API going forward by extracting `refuseToAccess`'s path list into a shared\nhelper both call), or implement the originally-recommended allowlist restricting the tool to\n`WorkspaceDir/temp/siyuan/*.log` for read and disabling write/delete/rename/copy entirely unless\nthe caller is Administrator, matching the tool's own advertised \"debugging/log reading only\"\nscope.","status":"published","published":"2026-10-27T14:43:57Z","modified":"2026-10-27T14:43:58Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:41:36.858527Z"},{"id":"GHSA-rp7c-4prv-9rrg","title":"Duplicate Advisory: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace filesDuplicate Advisory: ","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-c8r8-95hg-mp34. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.","status":"withdrawn","published":"2026-08-22T15:31:02Z","modified":"2026-10-27T14:43:49Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:41:36.858527Z"}],"nvd":[{"id":"CVE-2026-60083","description":"SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.","status":"published","published":"2026-08-22T13:16:39.263Z","modified":"2026-10-12T16:10:00.22Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-60083","title":"SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool","description":"SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.","status":"published","published":"2026-08-22T12:26:36.709Z","modified":"2026-11-05T23:25:40.521157828Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"GHSA-c8r8-95hg-mp34","title":"SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files","description":"## Summary\n\n`kernel/mcp/tools/file.go`'s `resolvePath()` includes an explicit comment stating its\nsensitive-path blocklist is meant to align with the HTTP file API's established blacklist\n(`refuseToAccess()` in `kernel/api/file.go`), following the remediation for GHSA-cvhv-7xhj-xjp8\n(\"Unauthenticated Administrator takeover exfiltrated via the MCP\"), which specifically\nrecommended restricting this tool's scope. In practice, the MCP tool implements only 1 of the\n4 static blocklist entries the HTTP API enforces.\n\n## Comparison\n\n`kernel/api/file.go` `refuseToAccess()` blocks:\n1. `conf/conf.json` (API token, cookie signing key, accessAuthCode)\n2. `data/snippets/conf.json`\n3. the entire `data/templates` directory\n4. `data/.siyuan/publishAccess.json`\n5. (dynamic, per-request) any path the current publish-mode session isn't authorized for\n\n`kernel/mcp/tools/file.go` `resolvePath()` blocks only:\n```go\nconfPath := filepath.Join(util.ConfDir, \"conf.json\")\nif abs == confPath {\n    return \"\", fmt.Errorf(\"access to conf.json is forbidden\")\n}\n```\nItems 2, 3, and 4 are absent. The tool's own `list`/`read`/`grep`/`find` actions remain fully\nfunctional against them.\n\n## Impact\n\nAn MCP client with access to the `file` tool (post-fix for GHSA-cvhv-7xhj-xjp8, i.e. a properly\nauthenticated Administrator-level caller) can read `data/.siyuan/publishAccess.json` directly:\n\n```go\ntype PublishAccessItem struct {\n    ID       string `json:\"id\"`\n    Visible  bool   `json:\"visible\"`\n    Password string `json:\"password\"` // plaintext; empty string = no password\n    Disable  bool   `json:\"disable\"`\n}\n```\n\nThis exposes the plaintext access password for every publish-mode-shared notebook/document,\nletting the reader bypass password protection on any publish-mode share. This is a serious\nsibling issue given the volume of publish-mode access-control bugs already reported against this\ncodebase — the passwords protecting exactly that feature are directly readable through a tool\nwhose own description says \"never use for workspace data.\"\n\n`data/templates` and `data/snippets/conf.json` are lower-severity but still inconsistent with\nthe HTTP API's own precedent for what counts as sensitive.\n\n## Why this is a distinct finding, not a duplicate\n\nGHSA-cvhv-7xhj-xjp8 was about *reachability* an unauthenticated Reader-tier JWT being forwarded\nto admin-scoped paths including `/mcp`. That has been fixed. This report is about the *tool's own\nscope* once reached by a legitimate, properly-authenticated caller, the remediation notes for\nthat same advisory explicitly called for restricting `resolvePath` to\n`WorkspaceDir/temp/siyuan/*.log`, which was not implemented; instead the tool retains\nworkspace-wide scope with only a single-file blocklist addition.\n\n## Suggested fix\n\nEither replicate the full `refuseToAccess()` blocklist in `resolvePath()` (minimum fix, keeps\nparity with the HTTP API going forward by extracting `refuseToAccess`'s path list into a shared\nhelper both call), or implement the originally-recommended allowlist restricting the tool to\n`WorkspaceDir/temp/siyuan/*.log` for read and disabling write/delete/rename/copy entirely unless\nthe caller is Administrator, matching the tool's own advertised \"debugging/log reading only\"\nscope.","status":"published","published":"2026-10-27T14:43:57Z","modified":"2026-11-05T23:25:40.521157828Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"GHSA-rp7c-4prv-9rrg","title":"Duplicate Advisory: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace filesDuplicate Advisory: ","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-c8r8-95hg-mp34. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.","status":"withdrawn","published":"2026-08-22T15:31:02Z","modified":"2026-10-27T15:00:04.993137322Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"GO-2026-6863","title":"SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files in github.com/siyuan-note/siyuan/kernel","status":"published","published":"2026-11-05T22:54:46Z","modified":"2026-11-05T23:15:14.561657736Z","updated_at":"2026-11-06T00:02:13.631839Z"}]}}