CVE-2026-100633: SiYuan Knowledge Management Auth Bypass

CVE-2026-100633 Overview

CVE-2026-100633 is an authorization bypass [CWE-863] in SiYuan, a self-hosted personal knowledge management system. The flaw affects versions 3.8.0 through 3.8.3 and resides in the Model Context Protocol (MCP) file tool's sensitive-path guard. The function util.IsForbiddenAbsPath(), invoked from resolvePath(), is applied only to the allowed root of recursive operations and not to each resolved descendant path. This is an incomplete fix for the earlier advisory GHSA-c8r8-95hg-mp34. An authenticated administrator using the in-app Agent or an external MCP server can read, copy, or overwrite protected workspace files that the denylist is meant to shield.

Critical Impact
Attackers with administrator access can exfiltrate TLS keys, configuration files, publish-access tokens, and kernel logs, and can overwrite protected files via unzip, enabling broader compromise of the SiYuan workspace.

Affected Products

SiYuan 3.8.0
SiYuan 3.8.1 through 3.8.2
SiYuan 3.8.3

Discovery Timeline

2026-09-26 - CVE-2026-100633 published to NVD
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-100633

Vulnerability Analysis

SiYuan exposes file operations through an MCP interface used by both the in-app Agent and an external MCP server. The resolvePath() helper calls util.IsForbiddenAbsPath() to block access to sensitive workspace paths such as conf/conf.json, TLS key material, data/snippets/conf.json, data/templates/, data/.siyuan/publishAccess.json, notebook .siyuan internals, and the kernel log.

For recursive operations the check runs only on the top-level allowed root. Descendant paths resolved during recursion are never re-evaluated. As a result, file.grep returns matching lines from protected descendants, file.copy moves protected descendants to attacker-controlled destinations where file.read can retrieve them, and unzip overwrites protected descendants using ordinary, lexically contained ZIP member names.

The MCP safety model compounds the issue. file.grep is globally classified as a safe action and bypasses per-call confirmation. Confirmation cards for file.copy and unzip display only the allowed root arguments, hiding the sensitive descendants that are actually touched.

Root Cause

The root cause is incomplete authorization enforcement during recursive traversal. The denylist is a path-level control applied at the entry point rather than at every file resolution. Any operation that expands a root into descendant paths therefore escapes the guard, matching the [CWE-863] incorrect authorization pattern.

Attack Vector

Exploitation requires an authenticated administrator session interacting with the MCP tool surface. The attacker instructs the Agent or an external MCP client to run file.grep, file.copy, or unzip against an allowed root that lexically contains a protected descendant. Because confirmation prompts only reveal the root, the operator may approve requests that silently touch sensitive files. See the GitHub Security Advisory GHSA-9g6v-r3xf-673q and the VulnCheck Path Traversal Advisory for technical details.

Detection Methods for CVE-2026-100633

Indicators of Compromise

MCP file.grep invocations whose results include lines from conf/conf.json, data/snippets/conf.json, data/.siyuan/publishAccess.json, or notebook .siyuan directories.
MCP file.copy operations where the destination path is an ordinary workspace location but the source root lexically contains protected descendants.
unzip operations whose ZIP archives contain member names matching protected workspace paths.
Unexpected reads of TLS private key files or the SiYuan kernel log by the MCP server process.

Detection Strategies

Audit MCP tool call logs for recursive operations rooted at parents of sensitive paths, especially the workspace root or data/.
Correlate file.copy events followed by file.read requests against the copied destination within a short window.
Alert on any unzip request whose archive listing resolves to a protected descendant path.

Monitoring Recommendations

Enable verbose MCP action logging and forward events to a centralized SIEM for retention and correlation.
Monitor file integrity on conf/conf.json, data/.siyuan/, data/snippets/, data/templates/, and TLS key material.
Track administrator session activity against the MCP interface and flag off-hours or automated agent usage.

How to Mitigate CVE-2026-100633

Immediate Actions Required

Upgrade SiYuan to version 3.8.4 or later, which applies the sensitive-path guard to every resolved descendant.
Rotate any TLS keys, publish-access tokens, and credentials stored in the SiYuan workspace that may have been exposed.
Restrict administrator access to the MCP interface and disable external MCP server exposure where it is not required.

Patch Information

The issue is fixed in SiYuan 3.8.4. The patched release moves the util.IsForbiddenAbsPath() check so that it applies to each resolved descendant path during recursive MCP file operations, not only to the allowed root. Refer to the GitHub Security Advisory GHSA-9g6v-r3xf-673q for commit references and release notes.

Workarounds

Disable the MCP file tool or the external MCP server until the upgrade to 3.8.4 is completed.
Limit administrator accounts and require manual confirmation for every file.grep, file.copy, and unzip call issued through the Agent.
Place SiYuan behind network controls that prevent untrusted clients from reaching the MCP endpoint.

bash

# Verify installed SiYuan version and upgrade to the patched release
siyuan --version
# Upgrade to 3.8.4 or later via the official release channel
# https://github.com/siyuan-note/siyuan/releases