Description

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive publish-access configuration and metadata.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T12:17:19.917Z",
  "pubdate": "2026-09-04T12:17:19.917Z",
  "executiveSummary": "SiYuan versions prior to v3.8.2 are susceptible to a path guard bypass vulnerability within the MCP file-access handler when deployed on Linux-based filesystems. This flaw originates from a case-sensitive matching discrepancy in the application's file access controls.\nBy submitting requests for case-variant paths, an unauthenticated or remote attacker can circumvent intended directory restrictions. This vulnerability leads to unauthorized information disclosure, specifically exposing the sensitive 'publishAccess.json' configuration file. Access to this file provides an attacker with critical internal configuration metadata, potentially facilitating further exploitation or reconnaissance of the affected deployment. The risk is high for Linux environments where the filesystem's case-sensitivity conflicts with the security filter's logic.",
  "technicalDetails": "The vulnerability resides in the MCP (Model Context Protocol) file-access handler mechanism utilized by SiYuan. The security logic implements a path guard intended to restrict access to sensitive system files, including 'publishAccess.json'. However, the filtering mechanism employs a case-sensitive string matching algorithm that fails to account for the case-insensitive behavior of various Linux filesystem configurations or simply creates a mismatch between the filter and the actual file lookup process.\nOn Linux filesystems, the operating system may treat different casing variations of a filename as distinct entries if the underlying filesystem (e.g., ext4, xfs) is configured as case-sensitive, or the application logic itself relies on a strict string comparison that does not normalize input paths before validation. If the path guard explicitly blocks 'publishAccess.json' but the application subsequently processes a request for 'PublishAccess.json', the filter fails to identify the path as forbidden.\nAttack flow: 1. An attacker identifies an endpoint leveraging the MCP file-access handler. 2. The attacker crafts a request targeting 'PublishAccess.json' instead of the restricted 'publishAccess.json'. 3. The path guard validator checks the input against a blocklist; because the check is case-sensitive, 'PublishAccess.json' does not match the blocked pattern 'publishAccess.json', allowing the request to proceed. 4. The underlying file system or file handling API resolves the case-variant path to the actual 'publishAccess.json' file due to filesystem behavior or normalized file resolution. 5. The application returns the contents of the protected file to the attacker.\nThis vulnerability effectively bypasses mandatory access control constraints, leading to the unauthorized disclosure of sensitive configuration metadata contained within the file. This information may include internal publication paths, security keys, or administrative settings that can be leveraged to escalate the attack chain."
}