CVE-2026-116168
Deferred Deferred - Pending Action

SiYuan MCP Asset Path Traversal Vulnerability

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116168
EUVD
EUVD-2026-109429

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan-note siyuan 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before version 3.8.7 has a path traversal vulnerability in its MCP asset tool. The validateAssetUploadPaths function uses an incomplete blacklist that misses sensitive files like .env. Authenticated attackers can upload local files into the workspace via the MCP asset upload action and read them back through the /assets/ HTTP endpoint.

Detection Guidance

Check SiYuan version with 'siyuan --version' or inspect the application directory. Look for unexpected files in the workspace, especially .env or similar files accessible via /assets/. Monitor HTTP requests to /assets/ for file retrieval attempts.

Impact Analysis

An attacker with access to the MCP server could read sensitive files from your system, such as .env files containing credentials or configuration secrets. This could lead to unauthorized access to your data or systems if those credentials are used elsewhere.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Exposure of credentials or personal data may result in compliance breaches and legal penalties.

Mitigation Strategies

Upgrade SiYuan to version 3.8.7 or later. If upgrading is not possible, restrict MCP asset tool paths by implementing a whitelist of allowed directories or expanding the blacklist to include .env, .env.local, .env.production, and other sensitive paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart