CVE-2026-85580
Received Received - Intake

SiYuan Path Guard Bypass Exposes PublishAccess.json

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive publish-access configuration and metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85580
EUVD
EUVD-2026-71003

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions before v3.8.2 have a path guard bypass vulnerability in the MCP file-access handler. Due to case-sensitive matching on Linux filesystems, attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json. This exposes sensitive publish-access configuration and metadata.

Detection Guidance

Check for unauthorized access to publishAccess.json by monitoring file reads with case variations like PublishAccess.json or PUBLISHACCESS.JSON. Use commands like 'find / -iname publishAccess.json' to locate the file and 'ls -la /path/to/publishAccess.json' to verify permissions. Check SiYuan logs for MCP handler requests with unusual case-sensitive paths.

Impact Analysis

This vulnerability allows low-privilege users to read sensitive metadata from the protected publishAccess.json file. It exposes publication configuration details, including visibility settings and password-related metadata, which could facilitate further unauthorized access.

Compliance Impact

This vulnerability could expose sensitive metadata and configuration details from the publishAccess.json file, which may include visibility settings and password-related information. Such unauthorized access to sensitive data could lead to violations of GDPR (General Data Protection Regulation) due to unauthorized data exposure and potential breaches of confidentiality. For HIPAA (Health Insurance Portability and Accountability Act), if the exposed data includes protected health information, it could result in compliance failures and unauthorized disclosures.

Mitigation Strategies

Upgrade SiYuan to version 3.8.2 or later immediately. If upgrading is not possible, restrict access to the publishAccess.json file using chmod and chown commands. Implement additional monitoring for file access attempts with case variations. Review and audit all publish-access configurations exposed by this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85580. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart