CVE-2026-100633

SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard util.IsForbiddenAbsPath, invoked from resolvePath is applied only to the allowed root of recursive operations and not to each resolved descendant path — an...

EUVD-2026-87727

SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard util.IsForbiddenAbsPath, invoked from resolvePath is applied only to the allowed root of recursive operations and not to each resolved descendant path — an...

CVE-2026-100633

The SiYuan personal knowledge management system (versions 3.8.0 through 3.8.3 ) contains a sensitive-path guard bypass in the MCP file tool . The root cause is that the util.IsForbiddenAbsPath() check (invoked via resolvePath()) is only applied to the root of recursive operations rather than each...