CVE-2026-116168 in SiYuan
Summary
by MITRE • 10/25/2026
SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in SiYuan versions prior to 3.8.7 represents a critical path traversal flaw within its Model Context Protocol (MCP) asset management subsystem, specifically stemming from inadequate input validation during file upload operations. The core technical deficiency lies in the validateAssetUploadPaths function, which is responsible for sanitizing user-supplied file paths before they are processed by the application. This function relies on a blacklist approach to filter out sensitive directories and files that should not be accessible or movable into the workspace environment. However, this security control is fundamentally flawed because it employs an incomplete list of prohibited patterns. While the implementation attempts to block access to certain system-level resources, it fails to account for critical configuration files such as .env files, which commonly store API keys, database credentials, and other high-value secrets in plaintext or encoded formats. This oversight allows authenticated users to bypass standard security restrictions by targeting these unlisted sensitive paths during asset uploads.
From an operational perspective, this vulnerability enables a significant escalation of privilege for any user who has valid authentication credentials within the SiYuan application. An attacker can leverage the MCP asset upload feature to copy local files from the server's filesystem into the accessible workspace directory structure. Once these files are placed in the designated location, they become retrievable via standard HTTP requests directed at the /assets/ endpoint. This mechanism effectively transforms a simple file upload interface into a powerful arbitrary file read vector. The attacker does not need to exploit complex binary vulnerabilities or buffer overflows; instead, they simply manipulate the path parameters sent during the asset transfer process to reference sensitive files outside of intended boundaries. Because the application subsequently serves these copied assets through its web server, the confidentiality of the stolen data is directly compromised without requiring further exploitation steps beyond initial authentication and file upload initiation.
The impact of this vulnerability extends beyond simple information disclosure, as it can lead to comprehensive system compromise depending on the sensitivity of the exposed files. If .env files or similar configuration artifacts are exfiltrated, attackers may obtain credentials for external services such as cloud storage providers, email servers, or database instances associated with the SiYuan deployment. These stolen tokens and passwords can be used to access other systems within the organization's infrastructure, facilitating lateral movement and deeper penetration of the network environment. Furthermore, since the vulnerability requires authentication, it is classified under attacks that target valid user accounts rather than unauthenticated remote exploitation. This distinction places the risk profile in a category where insider threats or compromised credentials pose a direct pathway to data loss, making it particularly dangerous for collaborative environments where multiple users have access to the application instance.
In terms of industry-standard classification frameworks, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The failure to properly validate and sanitize user input before using it in file system operations is a classic manifestation of this weakness. Additionally, the exploitation technique maps directly to MITRE ATT&CK techniques related to Data from Local System Retrieval, specifically T1083: File and Directory Discovery, followed by T1567: Exfiltration Over Web Service. The attacker utilizes legitimate application functionality (asset upload) to discover sensitive files and then uses the web server's asset serving capability to exfiltrate them over HTTP, blending reconnaissance with data theft in a single workflow that may evade basic security monitoring tools focused on external network traffic anomalies rather than internal file access patterns.
Mitigation strategies must prioritize immediate patching of the SiYuan application to version 3.8.7 or later, where the validateAssetUploadPaths function has been corrected to include comprehensive blacklisting and potentially switched to a whitelist-based approach for allowed directories. In environments where upgrading is not immediately feasible, administrators should implement strict network-level controls such as web application firewalls that inspect file upload parameters for path traversal sequences like ../ or attempts to access hidden files starting with dots. Additionally, restricting the permissions of the user account running the SiYuan service can limit the scope of accessible files on the underlying operating system, ensuring that even if a traversal occurs, the attacker cannot read highly sensitive configuration files stored in protected directories. Regular auditing of uploaded assets and monitoring for unusual HTTP requests targeting asset endpoints can also help detect ongoing exploitation attempts before significant data loss occurs.