CVE-2026-60083 · GHSA-c8r8-95hg-mp34

SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files

Risk score: 41/100
CVSS: 4.9 v3.1
Exploit chance (30 days): 0.4%
Published: 22 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is: SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like…
Affected: github.com/siyuan-note/siyuan/kernel (go) < 0.0.0-20260808051406-3542530c505f
Fix: Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260808051406-3542530c505f or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/siyuan-note/siyuan/kernel: Red, act today. SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish …

The flaws

CVE-2026-60083: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files (CVSS 4.9 · EPSS 0%)
CVE-2026-69085: SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking (CVSS 10.0 · EPSS 1%)
CVE-2026-73054: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream (CVSS 7.5 · EPSS 1%)
GHSA-9cqf-hhrq-7v45: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route (CVSS 8.6)

The fix

Upgrade github.com/siyuan-note/siyuan/kernel: 3.8.0 · 3.7.3 · 3.7.4 or later on your release line

Who is exposed: github.com/siyuan-note/siyuan/kernel (go) < 0.0.0-20260721043339-eef10568384e

Where it stands

Public proof of concept

Connects to

Same weakness: Incorrect authorisation (CWE-863). 344 other warnings in 30 days

Why it is Yellow

CVSS 4.9 medium
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/siyuan-note/siyuan/kernel	go	< 0.0.0-20260808051406-3542530c505f	0.0.0-20260808051406-3542530c505f

References

Original description

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.

Last activity 27 Oct 2026. Patch Forecast updates every hour.