CVE-2026-116168

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into th...

CVE-2026-116168

SiYuan versions prior to v3.8.7 are vulnerable to a path traversal flaw within the MCP asset tool . The root cause is that the validateAssetUploadPaths function relies on an incomplete sensitive-path blacklist, which fails to exclude files such as .env and other secrets. This allows authenticated...

CVE-2026-116168 SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into th...

EUVD-2026-109429

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into th...