Description

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-28T12:16:32.953Z",
  "pubdate": "2026-08-28T12:16:32.953Z",
  "executiveSummary": "SiYuan versions prior to 3.8.1 are susceptible to a path traversal vulnerability located within the asset.upload MCP tool.\nThe vulnerability arises from insufficient input validation of file paths, allowing for the exfiltration of sensitive system files outside of the defined workspace boundaries.\nAn attacker can leverage prompt injection techniques to manipulate the AI Agent into invoking the asset.upload tool with arbitrary absolute file paths.\nSuccessful exploitation permits unauthorized access to sensitive local files, such as SSH private keys, configuration files, or user credentials, by copying them into the accessible asset directory.\nThis flaw poses a significant risk to data confidentiality and system security, as it bypasses intended workspace sandboxing mechanisms.\nExploitation is facilitated through the AI Agent's interaction with the tool, requiring the attacker to successfully perform a prompt injection attack against the AI interface to trigger the malicious file upload request.\nThe impact includes the exposure of sensitive host information, potentially leading to privilege escalation or further system compromise depending on the nature of the exfiltrated data.",
  "technicalDetails": "The vulnerability exists within the asset.upload MCP (Model Context Protocol) tool component of SiYuan, which fails to enforce strict workspace boundary validation on incoming file path parameters.\nThe root cause is a lack of input sanitization and path normalization checks when processing requests directed at the asset.upload function. The tool implicitly trusts the path provided by the AI Agent, which can be coerced via prompt injection to accept absolute file paths rather than restricting operations to a designated sub-directory.\nIn a typical attack flow, the adversary crafts a malicious prompt designed to interact with the SiYuan AI Agent. This prompt instructs the agent to utilize the asset.upload tool to perform an operation on a sensitive target file located outside the workspace (e.g., /home/user/.ssh/id_rsa).\nBecause the underlying implementation does not perform effective checks such as 'path canonicalization' or 'directory traversal' filtering, the application resolves the requested absolute path directly, treating it as a legitimate source file.\nThe component then copies the contents of the unauthorized file into the SiYuan asset directory. Once the file is relocated to the assets folder, it becomes accessible through the standard SiYuan interface or application logic, allowing the attacker to retrieve the contents of the sensitive file via the UI or exported data.\nThis behavior bypasses standard filesystem isolation, effectively turning the AI Agent into a proxy for unauthorized file read operations. The vulnerability affects all versions of SiYuan prior to v3.8.1.\nThe exploit does not necessarily require direct network-level access to the file system API if the user can successfully manipulate the AI Agent's output. Authentication and privilege requirements are consistent with the context of the user running the SiYuan instance; if the application process has read permissions for the target file, the vulnerability allows the agent to bypass application-level access controls.\nPost-exploitation impact involves the total compromise of the targeted file's content, which may include credentials, private keys, or internal environment configurations, facilitating further lateral movement or unauthorized access."
}