Executive brief
SiYuan is a self-hosted personal knowledge management system that stores notes, configurations, and sensitive data like API tokens and TLS keys. In versions 3.8.0 through 3.8.3, authenticated administrators can bypass security restrictions protecting sensitive files through the MCP file tool, allowing them to read configuration files, API tokens, and other protected data, or overwrite critical system files. The vulnerability affects both the built-in Agent interface and external MCP servers, and is fixed in version 3.8.4.
Technical details
The vulnerability is an incomplete authorization fix in the MCP file tool's resolvePath() function, which applies the IsForbiddenAbsPath() guard only to root directories in recursive operations, not to each descendant path. An authenticated administrator can exploit three recursive operations (file.grep, file.copy, unzip) to bypass the protected-workspace-file denylist and access configuration files, TLS keys, API tokens, and publish access settings. The file.grep operation receives no per-call confirmation and returns full matching lines to the Agent/model, while file.copy and unzip confirmation cards omit the protected descendant paths being accessed.
Affected products
- SiYuan SiYuan 3.8.0 through 3.8.3
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 3.8.4