CVE-2026-100633
Deferred Deferred - Pending Action

SiYuan MCP File Tool Sensitive-Path Bypass

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPath(), invoked from resolvePath()) is applied only to the allowed root of recursive operations and not to each resolved descendant path — an incomplete fix for GHSA-c8r8-95hg-mp34. An authenticated administrator using the in-app Agent or the external MCP server can therefore bypass the protected-workspace-file denylist: file.grep can return matching lines from non-hidden protected descendants (for example conf/conf.json, TLS keys, data/snippets/conf.json, data/templates/, data/.siyuan/publishAccess.json, notebook .siyuan internals, or the kernel log), file.copy can copy protected descendants to an ordinary path where file.read can then retrieve them, and unzip can overwrite protected descendants using ordinary, lexically contained ZIP member names. Because file.grep is globally classified as a safe action, it receives no per-call confirmation, and the confirmation cards for file.copy and unzip show only the allowed root arguments. This issue is fixed in version 3.8.4. Suggested title: SiYuan 3.8.0 through 3.8.3 Sensitive-Path Guard Bypass in Recursive MCP File Operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100633
EUVD
EUVD-2026-87727

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siyuan siyuan From 3.8.0 (inc) to 3.8.3 (inc)
siyuan siyuan 3.8.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SiYuan versions 3.8.0 through 3.8.3. It involves an incomplete fix for a previous issue where the sensitive-path guard only checks the root directory during recursive file operations like file.grep, file.copy, and unzip. This allows bypassing file denylists, enabling unauthorized access to protected files such as configuration files, TLS keys, or kernel logs.

Detection Guidance

Check SiYuan version with 'siyuan --version' or inspect the application directory for version files. Monitor file operations via MCP logs if enabled. Look for unauthorized access attempts to protected paths like conf/conf.json or data/.siyuan/publishAccess.json.

Impact Analysis

An authenticated administrator could exploit this to read sensitive files (e.g., conf/conf.json with credentials), copy protected files to accessible locations, or overwrite protected files using crafted ZIP archives. This could lead to data leaks or corruption within the SiYuan workspace.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Unauthorized file access or overwrites may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade SiYuan to version 3.8.4 or later immediately. Disable MCP file operations if not required. Restrict admin access to SiYuan instances. Review file permissions on sensitive directories and audit recent file modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100633. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart