CVE-2026-116168

SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool

Published Oct 25, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.

Analysis

Technical impact

SiYuan versions earlier than 3.8.7 allow an authenticated user to influence the MCP asset upload process. The validateAssetUploadPaths function lacks a comprehensive blacklist, permitting uploads of sensitive files such as .env. Once uploaded, these files can be accessed through the public /assets/ HTTP path, exposing local file contents and compromising confidentiality.

Affected Systems

The affected product is SiYuan, specifically all releases prior to 3.8.7. Users running any older version risk unauthorized read access to local secrets and other files through the MCP asset upload interface.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA KEV, suggesting limited known exploitation. The attack requires authentication to use the MCP asset upload feature; an attacker can then upload a crafted file path to read arbitrary local files via the exposed HTTP endpoint.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

siyuan-note

siyuan

unaffected

Version	Status	Constraints
`0`	affected	< 3.8.7
`3.8.7`	unaffected	—

No data.

Vendor Product Versions

B3log

Siyuan

Version	Status	Scheme	Platform
`[0,3.8.7)`	affected	semver	—
`3.8.7`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade SiYuan to version 3.8.7 or newer to eliminate the path traversal flaw.
If immediate upgrade is not possible, restrict MCP asset upload capabilities to trusted administrative accounts or disable the feature entirely to prevent write access to sensitive files.
Ensure that the /assets/ endpoint enforces strict path validation and does not allow traversal, or apply a patch that implements a comprehensive blacklist to block secret file uploads.

Generated by OpenCVE AI on October 25, 2026 at 16:42 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.186% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q768-4j87-gf3w
https://www.vulncheck.com/advisories/siyuan-before-3.8.7-path-traversal-local-file-read-via-mcp-asset-tool

History

Nov 4, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.
Title		SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool
First Time appeared		B3log B3log siyuan
Weaknesses		CWE-22
CPEs		cpe:2.3:a:b3log:siyuan::::::::
Vendors & Products		B3log B3log siyuan
References		https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q768-4j87-gf3w https://www.vulncheck.com/advisories/siyuan-before-3.8.7-path-traversal-local-file-read-via-mcp-asset-tool
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`