CVE-2026-82233

Deferred Deferred - Pending Action

SiYuan Path Traversal in asset.upload MCP Tool

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-82233

EUVD

EUVD-2026-67685

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

SiYuan before v3.8.1 has a path traversal flaw in the asset.upload MCP tool. It allows arbitrary absolute file paths without validating workspace boundaries. Attackers can exploit this via prompt injection to make the AI Agent upload sensitive files like SSH keys or credentials from outside the workspace into the asset directory.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized file uploads or suspicious asset directory activity in SiYuan versions before v3.8.1. Review server logs for MCP tool usage, particularly asset.upload commands with absolute paths outside the workspace. Inspect the asset directory for unexpected files like SSH keys or credentials.

Impact Analysis

An attacker could access sensitive files such as SSH keys, credentials, or other confidential data stored outside the workspace. This could lead to unauthorized access, data breaches, or further compromise of systems relying on those credentials.

Compliance Impact

This vulnerability could result in unauthorized data exposure, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Non-compliance may lead to legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade SiYuan to v3.8.1 or later to patch the path traversal flaw. Restrict MCP tool access to trusted users and disable unnecessary tools. Monitor asset directories for unauthorized files and audit user prompts for prompt injection attempts. Implement workspace boundary validation if custom MCP tools are used.

Hi! I’m here to help you understand CVE-2026-82233. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70