{"id":"GO-2026-6655","revision":"5728c8774cf84aa8a21b5dc0ce3d4dd8","records":[{"revision":"5728c8774cf84aa8a21b5dc0ce3d4dd8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6655","aliases":["CVE-2026-82233","GHSA-p23f-cm6q-2qp8"],"title":"SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel","description":"SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-10-07T14:10:14+00:00","modifiedAt":"2026-10-07T17:56:03.8226177+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260813142104-b26a4a307b8a"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p23f-cm6q-2qp8","https://github.com/siyuan-note/siyuan/commit/b26a4a307b8ae5067387ea76ce1fad6b7f4bf9e7","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6655","license":"OSV · upstream source license applies","key":"osv:GO-2026-6655","identifiers":["GO-2026-6655","CVE-2026-82233","GHSA-p23f-cm6q-2qp8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}