Description

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView (kernel/model/attribute_view.go), which builds a filesystem path via filepath.Join without validating that id matches SiYuan's node-ID format. An authenticated MCP client can supply path traversal sequences in id to cause the kernel to copy an arbitrary file readable by the process into SiYuan's history directory (arbitrary file read) and then delete the original file (arbitrary file deletion). The corresponding HTTP API handler was hardened in GHSA-7hm9-v7vf-7g4w, but this MCP caller was not.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-17T11:16:39.873Z",
  "pubdate": "2026-08-17T11:16:39.873Z",
  "executiveSummary": "A path traversal vulnerability exists in the SiYuan kernel before v3.7.4 within the database_clean Model Context Protocol (MCP) tool. The flaw allows an authenticated MCP client to exploit insufficient input validation on the id parameter, leading to severe file system manipulation. Specifically, the vulnerability enables arbitrary file read capabilities where target files readable by the application process are copied into the SiYuan history directory, followed by arbitrary file deletion of the original source files.\nThe affected product is the SiYuan kernel in versions prior to v3.7.4. The risk implications are critical, as malicious actors with authenticated access can delete essential files or extract sensitive data from the host system. The attack requires authentication as an MCP client and relies on supplying crafted path traversal sequences within the id parameter of the database_clean tool. While the corresponding HTTP API handler was previously hardened under GHSA-7hm9-v7vf-7g4w, the MCP caller interface remained unpatched and vulnerable.",
  "technicalDetails": "The root cause of the vulnerability is inadequate input sanitization within the database_clean MCP tool implemented in the SiYuan kernel. Prior to version v3.7.4, the vulnerable component performs only a basic empty-string validation check on the id parameter before directly passing it to the RemoveUnusedAttributeView function located in kernel/model/attribute_view.go.\nThe vulnerable function constructs filesystem paths using Go's filepath.Join standard library without enforcing strict validation to ensure that the supplied id strictly conforms to the expected SiYuan node-ID format. Because path traversal sequences such as dot-dot-slash are not filtered out, an authenticated MCP client can inject directory traversal payloads into the id parameter.\nThe attack flow proceeds as follows: First, an authenticated attacker interacts with the MCP interface, supplying a crafted payload containing path traversal sequences in the id parameter of the database_clean tool. Second, the kernel processes this input via filepath.Join within RemoveUnusedAttributeView, resolving the path outside of the intended storage directory and targeting arbitrary files on the underlying filesystem that are readable by the SiYuan process. Third, the application copies the targeted arbitrary file into SiYuan's internal history directory, achieving an arbitrary file read. Finally, the application executes a deletion routine on the original file, resulting in arbitrary file deletion.\nThe affected versions include all SiYuan kernel releases prior to v3.7.4. The exploitation vector requires network exposure to the MCP interface, valid authentication credentials as an MCP client, and standard process-level file permissions on the host system."
}