CVE-2026-100633 in SiYuan
Summary
by MITRE • 09/26/2026
SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard (util.IsForbiddenAbsPath(), invoked from resolvePath()) is applied only to the allowed root of recursive operations and not to each resolved descendant path — an incomplete fix for GHSA-c8r8-95hg-mp34. An authenticated administrator using the in-app Agent or the external MCP server can therefore bypass the protected-workspace-file denylist: file.grep can return matching lines from non-hidden protected descendants (for example conf/conf.json, TLS keys, data/snippets/conf.json, data/templates/, data/.siyuan/publishAccess.json, notebook .siyuan internals, or the kernel log), file.copy can copy protected descendants to an ordinary path where file.read can then retrieve them, and unzip can overwrite protected descendants using ordinary, lexically contained ZIP member names. Because file.grep is globally classified as a safe action, it receives no per-call confirmation, and the confirmation cards for file.copy and unzip show only the allowed root arguments. This issue is fixed in version 3.8.4. Suggested title: SiYuan 3.8.0 through 3.8.3 Sensitive-Path Guard Bypass in Recursive MCP File Operations.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
SiYuan, a self-hosted personal knowledge management system, contains a critical security vulnerability in versions 3.8.0 through 3.8.3 related to its Model Context Protocol (MCP) file tool implementation. This flaw represents an incomplete fix for the previously identified issue GHSA-c8r8-95hg-mp34 and stems from insufficient path validation logic within recursive operations. The core technical defect lies in how the sensitive-path guard, specifically the util.IsForbiddenAbsPath function invoked via resolvePath(), is applied during file system traversal. While the security mechanism correctly validates the initial allowed root directory to ensure it falls within permitted boundaries, it fails to recursively validate each descendant path resolved during subsequent operations. This architectural oversight means that while the entry point of a recursive operation may be legitimate, any subdirectories or files accessed deeper in the hierarchy are not subjected to the same restrictive checks, effectively creating a bypass for access control policies designed to protect sensitive workspace data.
The operational impact of this vulnerability is severe for authenticated administrators who utilize either the in-app Agent interface or an external MCP server connection. Because the path validation logic does not extend to descendant paths, attackers can exploit specific file manipulation tools exposed by the system to read, copy, and overwrite protected files that should remain inaccessible. Specifically, the file.grep tool allows users to search for matching lines within files; since this action is globally classified as safe, it executes without requiring per-call confirmation or additional security checks. Consequently, an attacker can use grep to extract sensitive content from non-hidden protected descendants such as configuration files like conf/conf.json, TLS private keys, snippet configurations in data/snippets/conf.json, template directories, internal notebook metadata located in .siyuan folders, publish access credentials found in data/.siyuan/publishAccess.json, and even kernel logs. These actions bypass the denylist intended to shield such sensitive artifacts from unauthorized exposure.
Beyond information disclosure through reading files, the vulnerability also permits data exfiltration via copying and potential integrity compromise through overwriting. The file.copy tool allows an authenticated user to duplicate protected descendant files into ordinary, accessible paths where they can subsequently be retrieved using the file.read function. This two-step process effectively neutralizes the protection offered by the denylist by moving sensitive data out of its restricted context. Furthermore, the unzip utility presents a risk of overwriting protected descendants. By utilizing ordinary ZIP member names that are lexically contained within the allowed root but point to forbidden paths deeper in the hierarchy, an attacker can overwrite critical system files or configuration data with malicious content. The confirmation cards displayed for file.copy and unzip operations only show the arguments related to the allowed root, providing no visibility into the actual target path of the descendant being manipulated, thereby deceiving the administrator about the true scope of the operation.
This vulnerability aligns closely with CWE-284 Improper Access Control, as it involves a failure in enforcing intended restrictions on authorized actors accessing resources. It also relates to CWE-732 Incorrect Permission Assignment for Critical Resource, given that sensitive configuration and credential files are exposed beyond their intended scope. From an offensive security perspective, the exploitation techniques mirror ATT&CK T1083 File and Directory Discovery, as the attacker enumerates and accesses protected paths, and T1560 Archive Collected Data when using zip or copy mechanisms to exfiltrate information. The lack of granular confirmation for grep operations further exacerbates the risk by removing a layer of user awareness that might otherwise prevent accidental data leakage.
The recommended mitigation is straightforward: administrators must upgrade SiYuan to version 3.8.4, which addresses this incomplete fix by ensuring that path validation is applied consistently to all resolved descendant paths during recursive file operations. Until such an update is deployed, organizations should restrict access to the MCP server and in-app Agent interfaces to only those users who absolutely require it, minimizing the attack surface for authenticated administrators. Additionally, implementing network-level controls to limit exposure of these services can provide a temporary layer of defense against exploitation attempts targeting this specific path traversal logic flaw.