SiYuan: MCP File Tool's Blocklist Is Incomplete Relative To The HTTP File API It Claims To Align With, Exposing Publish-

🗓️ 28 Oct 2026 08:51:42Reported by Veracode Vulnerability DatabaseType

Incomplete blocklist in SiYuan MCP File Tool allows reading publishAccess.json.

Reporter	Title	Published	Views	Family All 12
CVE	CVE-2026-60083	22 Aug 202612:26	–	cve
Cvelist	CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool	22 Aug 202612:26	–	cvelist
EUVD	EUVD-2026-64268	27 Oct 202614:43	–	euvd
Github Security Blog	SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files	27 Oct 202614:43	–	github
Github Security Blog	Duplicate Advisory: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace filesDuplicate Advisory:	22 Aug 202615:31	–	github
Mend	CVE-2026-60083	22 Aug 202612:26	–	mend
NVD	CVE-2026-60083	22 Aug 202613:16	–	nvd
osv_cve	CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool	22 Aug 202612:26	–	osv_cve
osv_ghsa	GHSA-C8R8-95HG-MP34 SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files	27 Oct 202614:43	–	osv_ghsa
Positive Technologies	PT-2026-79543	22 Aug 202600:00	–	ptsecurity