CVE-2026-60083: SiYuan Information Disclosure Vulnerability

CVE-2026-60083 Overview

CVE-2026-60083 is an incomplete path blocklist vulnerability in SiYuan, a personal knowledge management application. Versions before v3.8.0 fail to restrict access to sensitive workspace files through the Model Context Protocol (MCP) file tool. Authenticated administrators can bypass the blocklist and read files protected by the HTTP API. The exposure includes plaintext publish-mode passwords stored in data/.siyuan/publishAccess.json, along with data/templates and data/snippets/conf.json. The flaw is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated administrators can retrieve plaintext publish-mode credentials and other protected workspace files, enabling credential theft and lateral access to published content.

Affected Products

SiYuan versions prior to v3.8.0
SiYuan MCP file tool component
SiYuan workspace HTTP API surface

Discovery Timeline

2026-08-22 - CVE-2026-60083 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-60083

Vulnerability Analysis

SiYuan exposes an MCP file tool that allows programmatic access to workspace files. The tool implements a path blocklist intended to mirror the sensitive-file restrictions enforced by the HTTP API. The blocklist is incomplete and omits several protected paths. As a result, authenticated administrators can request files through the MCP interface that they cannot retrieve through the HTTP API.

The most impactful exposure is data/.siyuan/publishAccess.json, which stores publish-mode passwords in plaintext. Attackers with administrator credentials can also read data/templates and data/snippets/conf.json. These files can contain custom templates, snippet configuration, and other workspace secrets.

Root Cause

The root cause is inconsistent authorization enforcement between two access paths to the same underlying files. The HTTP API applies a stricter set of restrictions, while the MCP file tool relies on a separate, narrower blocklist. This divergence is a classic [CWE-863] incorrect authorization pattern where a secondary interface fails to replicate the security controls of the primary interface.

Attack Vector

Exploitation requires network access to the SiYuan instance and valid administrator credentials. An attacker uses the MCP file tool to request paths that are absent from the incomplete blocklist. The server returns the file contents without applying the HTTP API restrictions. Retrieving data/.siyuan/publishAccess.json yields plaintext publish-mode passwords that can be reused to access published content or pivot to other systems where the credentials are reused. Refer to the GitHub Security Advisory GHSA-c8r8-95hg-mp34 for advisory-level detail.

Detection Methods for CVE-2026-60083

Indicators of Compromise

MCP file tool requests referencing data/.siyuan/publishAccess.json, data/templates, or data/snippets/conf.json.
Unexpected read activity on workspace configuration files outside normal user or plugin behavior.
Publish-mode account logins from unfamiliar IP addresses following administrator MCP activity.

Detection Strategies

Enable and centralize SiYuan application logs, then alert on MCP file tool reads targeting data/.siyuan/* paths.
Correlate administrator authentication events with MCP file tool invocations to spot anomalous file access sequences.
Baseline normal MCP file tool usage per administrator and flag deviations in accessed paths or request volume.

Monitoring Recommendations

Monitor filesystem access to publishAccess.json, templates/, and snippets/conf.json using host-based file integrity tools.
Track outbound authentication attempts to SiYuan publish endpoints for signs of credential reuse.
Review reverse proxy or load balancer logs for MCP endpoint traffic originating from unexpected clients.

How to Mitigate CVE-2026-60083

Immediate Actions Required

Upgrade SiYuan to v3.8.0 or later on all workspaces exposed to the MCP file tool.
Rotate all publish-mode passwords stored in data/.siyuan/publishAccess.json after upgrading.
Audit administrator accounts and revoke access for any account no longer required.
Restrict network reachability of the SiYuan instance to trusted management networks where possible.

Patch Information

The issue is resolved in SiYuan v3.8.0, which extends the MCP file tool blocklist to cover the sensitive workspace paths already protected by the HTTP API. Patch and advisory details are published in the GitHub Security Advisory GHSA-c8r8-95hg-mp34 and the VulnCheck Advisory.

Workarounds

Disable the MCP integration on affected SiYuan instances until the upgrade to v3.8.0 is complete.
Enforce strong, unique administrator credentials and multi-factor authentication on any fronting proxy.
Place the SiYuan service behind a VPN or IP allowlist to limit exposure to authenticated attackers.

bash

# Verify the installed SiYuan version and confirm it is v3.8.0 or later
siyuan --version