Duplicate Advisory: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace filesDuplicate Advisory:

🗓️ 22 Aug 2026 15:31:02Reported by GitHub Advisory DatabaseType

Incomplete path blocklist in SiYuan MCP file tool allows authenticated admins to read sensitive files.

Reporter	Title	Published	Views	Family All 10
CVE	CVE-2026-60083	22 Aug 202612:26	–	cve
Cvelist	CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool	22 Aug 202612:26	–	cvelist
EUVD	EUVD-2026-64268	27 Oct 202614:43	–	euvd
Github Security Blog	SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files	27 Oct 202614:43	–	github
Mend	CVE-2026-60083	22 Aug 202612:26	–	mend
NVD	CVE-2026-60083	22 Aug 202613:16	–	nvd
osv_ghsa	GHSA-C8R8-95HG-MP34 SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files	27 Oct 202614:43	–	osv_ghsa
Positive Technologies	PT-2026-79543	22 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-60083: Incorrect Authorization	22 Aug 202600:00	–	rapid7
Vulnrichment	CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool	22 Aug 202612:26	–	vulnrichment

Vulners

Node

Source	Link
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-60083
vulncheck	www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool
github	www.github.com/advisories/GHSA-rp7c-4prv-9rrg

27 Oct 2026 14:43Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.14.9

CVSS 46.9

EPSS0.00391

SSVC