CVE-2026-60083: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files
kernel/mcp/tools/file.go’s resolvePath() includes an explicit comment stating its
sensitive-path blocklist is meant to align with the HTTP file API’s established blacklist
(refuseToAccess() in kernel/api/file.go), following the remediation for GHSA-cvhv-7xhj-xjp8
(“Unauthenticated Administrator takeover exfiltrated via the MCP”), which specifically
recommended restricting this tool’s scope. In practice, the MCP tool implements only 1 of the
4 static blocklist entries the HTTP API enforces.
References
- github.com/advisories/GHSA-c8r8-95hg-mp34
- github.com/siyuan-note/siyuan/commit/3542530c505f13aa3fbd0343627409ca6c000dd2
- github.com/siyuan-note/siyuan/releases/tag/v3.8.0
- github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34
- nvd.nist.gov/vuln/detail/CVE-2026-60083
- www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool
Code Behaviors & Features
Detect and mitigate CVE-2026-60083 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →