Description

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-22T13:16:39.263Z",
  "pubdate": "2026-08-22T13:16:39.263Z",
  "executiveSummary": "An information disclosure vulnerability exists in SiYuan versions before v3.8.0 due to an incomplete path blocklist implemented within the MCP file tool. This security flaw fails to adequately restrict access to sensitive workspace files that are otherwise protected by the application HTTP API. The vulnerability allows authenticated administrative users to bypass intended file access restrictions and read plaintext credentials and configuration data. Specifically, attackers can retrieve publish-mode passwords from data/.siyuan/publishAccess.json, as well as access other critical system directories including data/templates and data/snippets/conf.json. The primary risk implication is the unauthorized exposure of sensitive administrative secrets and configuration files, potentially facilitating further compromise of the underlying system or connected services. Exploitation of this vulnerability requires administrative authentication, meaning an attacker must already possess valid high-privilege credentials to interact with the vulnerable MCP file tool and supply malicious file paths designed to evade the inadequate path validation logic.",
  "technicalDetails": "The vulnerability resides within the MCP file tool component of SiYuan, specifically in how it validates and restricts file system paths before processing read requests. The root cause is an incomplete path blocklist mechanism that fails to comprehensively filter or sanitize user-supplied file paths targeting sensitive directories within the workspace. Rather than employing a robust allowlist or canonical path resolution strategy that enforces strict boundary checks, the application relies on a flawed blocklist that can be bypassed to access protected resources.\nThe affected product is SiYuan, specifically all versions prior to v3.8.0. The vulnerable component is the MCP file tool, which is exposed via the application interface and relies on inadequate input validation for file retrieval operations. Exploitation requires authenticated access with administrator privileges, indicating that the attacker must operate within an administrative security context to interact with the vulnerable endpoint.\nThe attack flow proceeds as follows: First, the authenticated administrator crafts a malicious request targeting the MCP file tool. This request includes specific file paths designed to bypass the insufficient blocklist filters. For instance, the attacker requests sensitive files such as data/.siyuan/publishAccess.json, data/templates, or data/snippets/conf.json. Because the path blocklist fails to intercept these specific paths, the application processes the request, reads the requested files from the underlying file system, and returns the plaintext contents to the user.\nThe post-exploitation impact includes the unauthorized acquisition of plaintext publish-mode passwords stored in data/.siyuan/publishAccess.json and the exposure of proprietary templates and configuration settings from data/snippets/conf.json. This compromises the confidentiality of the workspace configuration and can lead to broader security implications if exposed credentials are reused across other administrative interfaces or external services."
}