CVE-2026-85580 in SiYuan
Summary
by MITRE • 09/04/2026
SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive publish-access configuration and metadata.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The security flaw identified in SiYuan versions prior to v3.8.2 represents a critical path traversal vulnerability rooted in improper input validation within the Model Context Protocol (MCP) file access handler. This specific component is responsible for managing read operations on files associated with the application's publishing functionality, particularly those governing user permissions and access controls. The core technical deficiency lies in how the system validates requested file paths against a predefined allowlist or protected directory structure. Instead of normalizing the input path to resolve any case variations before performing security checks, the implementation relies strictly on case-sensitive string matching when operating on Linux-based filesystems. This architectural oversight creates a predictable bypass mechanism that allows unauthorized actors to circumvent access restrictions designed to protect sensitive configuration data.
From an operational perspective, this vulnerability enables remote attackers to read files that are explicitly intended to be protected from public or unauthenticated access. By crafting HTTP requests with file paths where the case of specific characters differs from the expected secure path, such as requesting PublishAccess.json instead of publishAccess.json, an attacker can successfully retrieve the contents of these restricted resources. The primary target in this scenario is the publishAccess.json configuration file, which typically contains metadata regarding who has permission to publish content and how those permissions are structured. Accessing this file does not require authentication if the MCP endpoint itself is exposed or accessible without sufficient verification, making it a significant risk for applications that expose such interfaces over networks.
The impact of exploiting this vulnerability extends beyond simple data disclosure. The publishAccess.json file often contains sensitive information about user roles, permission scopes, and potentially internal identifiers linked to content publishing workflows. An attacker who gains access to this metadata can map out the security posture of the SiYuan instance, identifying which users have elevated privileges or understanding how the system segments public versus private content. This intelligence gathering phase is critical for subsequent attacks, as it allows adversaries to tailor further exploitation attempts against specific high-value targets within the application ecosystem. The disclosure undermines the confidentiality integrity required for secure configuration management and exposes internal operational details that should remain hidden from external observers.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-20 Improper Input Validation, specifically regarding path traversal or case-sensitivity issues in file access controls. It also maps to MITRE ATT&CK technique T1530 Data from Local System Repositories and potentially T1087 Account Discovery if the metadata reveals user account structures. The root cause is a failure to canonicalize paths before performing security checks, which is a common pitfall when developers assume that case-sensitive matching on Linux provides sufficient protection against path manipulation attacks without considering how different input representations can bypass string-based allowlists.
To mitigate this vulnerability, organizations running SiYuan must upgrade immediately to version v3.8.2 or later where the file access handler has been patched to normalize paths and enforce consistent case-insensitive comparisons for security checks regardless of the underlying filesystem's default behavior. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict access to the MCP endpoints that handle file operations. Additionally, input validation logic on any custom integrations or proxies sitting in front of SiYuan can help by normalizing all incoming path requests to a standard case before they reach the application server. Regular security audits focusing on how configuration files are served and accessed will help identify similar weaknesses in other parts of the system that may rely on fragile string matching for access control decisions.