{"id":"CVE-2026-60083","revision":null,"records":[{"revision":"0732190b0f244730a9dbb305fed77061","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-60083","aliases":[],"title":"SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool","description":"SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.","state":0,"publishedAt":"2026-08-22T12:26:36.709+00:00","modifiedAt":"2026-08-24T18:41:00.99+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.8.0\"\n                        },\n                        {\n                            \"version\": \"3.8.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.9,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34","https://www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-60083","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-60083","identifiers":["CVE-2026-60083"]},"retained":false,"historicalAffected":[]},{"revision":"be649d2fe782499d9ab2402d49ddc09a","observedAt":"2026-10-30T10:52:17.199+00:00","statement":{"source":"euvd","id":"EUVD-2026-64268","aliases":["CVE-2026-60083","GHSA-rp7c-4prv-9rrg","GHSA-c8r8-95hg-mp34"],"title":"SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files","description":"SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34","https://www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool","https://nvd.nist.gov/vuln/detail/CVE-2026-60083","https://github.com/siyuan-note/siyuan/commit/3542530c505f13aa3fbd0343627409ca6c000dd2","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64268","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 27, 2026, 2:43:57 PM","dateUpdated":"Oct 27, 2026, 2:43:57 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-64268","identifiers":["EUVD-2026-64268","CVE-2026-60083","GHSA-rp7c-4prv-9rrg","GHSA-c8r8-95hg-mp34"]},"retained":false,"historicalAffected":[]},{"revision":"5d8ddf3af1a147d998de4813efd3851d","observedAt":"2026-10-27T15:15:14.036+00:00","statement":{"source":"nvd","id":"CVE-2026-60083","aliases":[],"title":"SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passw…","description":"SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.","state":0,"publishedAt":"2026-08-22T13:16:39.263+00:00","modifiedAt":"2026-10-12T16:10:00.22+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.9,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34","https://www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-60083","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-08-22T13:16:39.263","lastModified":"2026-10-12T16:10:00.220"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-60083","identifiers":["CVE-2026-60083"]},"retained":false,"historicalAffected":[]},{"revision":"7e83c44355094a9abc9bc9e670f65cc8","observedAt":"2026-10-27T15:14:43.05+00:00","statement":{"source":"osv","id":"GHSA-c8r8-95hg-mp34","aliases":["CVE-2026-60083"],"title":"SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files","description":"## Summary\n\n`kernel/mcp/tools/file.go`'s `resolvePath()` includes an explicit comment stating its\nsensitive-path blocklist is meant to align with the HTTP file API's established blacklist\n(`refuseToAccess()` in `kernel/api/file.go`), following the remediation for GHSA-cvhv-7xhj-xjp8\n(\"Unauthenticated Administrator takeover exfiltrated via the MCP\"), which specifically\nrecommended restricting this tool's scope. In practice, the MCP tool implements only 1 of the\n4 static blocklist entries the HTTP API enforces.\n\n## Comparison\n\n`kernel/api/file.go` `refuseToAccess()` blocks:\n1. `conf/conf.json` (API token, cookie signing key, accessAuthCode)\n2. `data/snippets/conf.json`\n3. the entire `data/templates` directory\n4. `data/.siyuan/publishAccess.json`\n5. (dynamic, per-request) any path the current publish-mode session isn't authorized for\n\n`kernel/mcp/tools/file.go` `resolvePath()` blocks only:\n```go\nconfPath := filepath.Join(util.ConfDir, \"conf.json\")\nif abs == confPath {\n    return \"\", fmt.Errorf(\"access to conf.json is forbidden\")\n}\n```\nItems 2, 3, and 4 are absent. The tool's own `list`/`read`/`grep`/`find` actions remain fully\nfunctional against them.\n\n## Impact\n\nAn MCP client with access to the `file` tool (post-fix for GHSA-cvhv-7xhj-xjp8, i.e. a properly\nauthenticated Administrator-level caller) can read `data/.siyuan/publishAccess.json` directly:\n\n```go\ntype PublishAccessItem struct {\n    ID       string `json:\"id\"`\n    Visible  bool   `json:\"visible\"`\n    Password string `json:\"password\"` // plaintext; empty string = no password\n    Disable  bool   `json:\"disable\"`\n}\n```\n\nThis exposes the plaintext access password for every publish-mode-shared notebook/document,\nletting the reader bypass password protection on any publish-mode share. This is a serious\nsibling issue given the volume of publish-mode access-control bugs already reported against this\ncodebase — the passwords protecting exactly that feature are directly readable through a tool\nwhose own description says \"never use for workspace data.\"\n\n`data/templates` and `data/snippets/conf.json` are lower-severity but still inconsistent with\nthe HTTP API's own precedent for what counts as sensitive.\n\n## Why this is a distinct finding, not a duplicate\n\nGHSA-cvhv-7xhj-xjp8 was about *reachability* an unauthenticated Reader-tier JWT being forwarded\nto admin-scoped paths including `/mcp`. That has been fixed. This report is about the *tool's own\nscope* once reached by a legitimate, properly-authenticated caller, the remediation notes for\nthat same advisory explicitly called for restricting `resolvePath` to\n`WorkspaceDir/temp/siyuan/*.log`, which was not implemented; instead the tool retains\nworkspace-wide scope with only a single-file blocklist addition.\n\n## Suggested fix\n\nEither replicate the full `refuseToAccess()` blocklist in `resolvePath()` (minimum fix, keeps\nparity with the HTTP API going forward by extracting `refuseToAccess`'s path list into a shared\nhelper both call), or implement the originally-recommended allowlist restricting the tool to\n`WorkspaceDir/temp/siyuan/*.log` for read and disabling write/delete/rename/copy entirely unless\nthe caller is Administrator, matching the tool's own advertised \"debugging/log reading only\"\nscope.","state":0,"publishedAt":"2026-10-27T14:43:57+00:00","modifiedAt":"2026-10-27T15:00:04.5023388+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260808051406-3542530c505f"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34","https://nvd.nist.gov/vuln/detail/CVE-2026-60083","https://github.com/siyuan-note/siyuan/commit/3542530c505f13aa3fbd0343627409ca6c000dd2","https://github.com/siyuan-note/siyuan","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0","https://www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool"],"sourceUrl":"https://github.com/advisories/GHSA-c8r8-95hg-mp34","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-c8r8-95hg-mp34","identifiers":["GHSA-c8r8-95hg-mp34","CVE-2026-60083"]},"retained":false,"historicalAffected":[]},{"revision":"5a74bb98eb314f8e9ff063d3d237cb3a","observedAt":"2026-10-27T15:14:43.05+00:00","statement":{"source":"osv","id":"GHSA-rp7c-4prv-9rrg","aliases":[],"title":"Duplicate Advisory: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace filesDuplicate Advisory: ","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-c8r8-95hg-mp34. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.","state":2,"publishedAt":"2026-08-22T15:31:02+00:00","modifiedAt":"2026-10-27T15:00:04.9931373+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34","https://nvd.nist.gov/vuln/detail/CVE-2026-60083","https://www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool"],"sourceUrl":"https://github.com/advisories/GHSA-rp7c-4prv-9rrg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rp7c-4prv-9rrg","identifiers":["GHSA-rp7c-4prv-9rrg"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T16:47:08.0799506+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T16:47:08.0799506+00:00","lastSuccessAt":"2026-10-30T16:47:08.2603913+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.2603923+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-d7b222ecfb3b37ed75e1512e40fdcf28594abff2a8568f1274ffe87891d61caa","complete":true,"records":417228,"lastAttemptAt":"2026-10-30T16:45:32.5536592+00:00","lastSuccessAt":"2026-10-30T16:45:32.4100997+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:45:32.5536592+00:00","snapshotPublishedAt":"2026-10-30T16:25:31+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b29727a527764786ad7f968eef139c25","complete":false,"records":13527,"lastAttemptAt":"2026-10-30T16:59:20.2596173+00:00","lastSuccessAt":"2026-10-30T16:59:20.255+00:00","error":"74 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-30T16:59:20.255+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":12149,"expectedIdentifiers":13605,"failedIdentifiers":74},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T16:47:08.0799506+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T16:47:08.0799506+00:00","lastSuccessAt":"2026-10-30T16:47:08.2616584+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.2616589+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0f2f428ccf42491d9927e55626b8fc62","complete":false,"records":13545,"lastAttemptAt":"2026-10-30T16:47:33.5927086+00:00","lastSuccessAt":"2026-10-30T16:47:33.589+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:33.589+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13603,"expectedIdentifiers":13605,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-e091d9104aae1991994c868b5fad0248c9b288abafb7672fca8ae6500f97e080","complete":true,"records":9808,"lastAttemptAt":"2026-10-30T16:47:08.0351821+00:00","lastSuccessAt":"2026-10-30T15:47:48.5635219+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.0351821+00:00","snapshotPublishedAt":"2026-10-30T15:23:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T16:45:32.7049631+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:45:32.7049631+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f63fa91e750071ae88c9f82019ecd6c982fa4fcc1d3dc5ceb5d9c642fb6bf05c","complete":true,"records":3023,"lastAttemptAt":"2026-10-30T16:47:08.0492653+00:00","lastSuccessAt":"2026-10-30T11:49:36.4759887+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:08.0492653+00:00","snapshotPublishedAt":"2026-10-30T11:18:14+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5a294989873fb9168d8ae38882a7a1451dd62315f67b71899ceec86dfb29d13b","complete":true,"records":230954,"lastAttemptAt":"2026-10-30T16:47:07.9043788+00:00","lastSuccessAt":"2026-10-30T16:47:06.5719002+00:00","error":null,"lastVerifiedAt":"2026-10-30T16:47:07.9043788+00:00","snapshotPublishedAt":"2026-10-30T16:33:30+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}