CVE-2026-82233 Overview
CVE-2026-82233 is a path traversal vulnerability [CWE-22] in SiYuan, a personal knowledge management application, affecting versions prior to v3.8.1. The flaw exists in the asset.upload Model Context Protocol (MCP) tool, which accepts arbitrary absolute file paths without validating that they reside within the workspace boundary. Attackers can leverage prompt injection against an AI Agent connected to SiYuan to upload sensitive files, such as SSH keys or credentials, from anywhere on the host filesystem into the asset directory. The vulnerability requires low privileges and user interaction, but exposes high-confidentiality data.
Critical Impact
Remote attackers can exfiltrate arbitrary files from a victim's host by injecting prompts that instruct the AI Agent to invoke asset.upload with absolute paths pointing to sensitive files outside the workspace.
Affected Products
- SiYuan versions before v3.8.1
- SiYuan MCP integration (asset.upload tool)
- Deployments exposing SiYuan MCP to AI Agents
Discovery Timeline
- 2026-08-28 - CVE-2026-82233 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-82233
Vulnerability Analysis
SiYuan exposes an MCP tool named asset.upload that allows an AI Agent to import files as workspace assets. The tool accepts a file path parameter and copies the referenced file into the SiYuan workspace assets/ directory. In versions before v3.8.1, the handler performs no validation that the supplied path is relative to, or contained within, the workspace root. Any absolute path readable by the SiYuan process is accepted, including paths that traverse outside the workspace such as /home/user/.ssh/id_rsa or C:\Users\victim\.aws\credentials.
Because the tool is invoked by an AI Agent acting on natural-language instructions, an attacker who can inject content into the model's context, through a shared note, a web page the agent reads, or a document opened during a session, can steer the agent to call asset.upload with attacker-chosen paths. The uploaded file becomes accessible in the asset directory and can subsequently be exfiltrated through additional agent actions or shared links.
Root Cause
The root cause is missing workspace boundary validation in the asset.upload MCP handler. The code does not canonicalize the requested path or verify that the resolved path is a descendant of the workspace directory. This is a classic path traversal weakness [CWE-22] compounded by the trust boundary introduced by AI Agent tool invocation.
Attack Vector
Exploitation is network-reachable through the MCP interface and requires user interaction, typically the victim running an AI Agent session against their SiYuan instance. The attacker delivers a prompt injection payload through untrusted content the agent processes. The agent then issues an asset.upload call with an absolute path targeting a sensitive file. The file is copied into the workspace asset store, from which the adversary retrieves it. See the GitHub Security Advisory and the VulnCheck Path Traversal Advisory for technical details.
Detection Methods for CVE-2026-82233
Indicators of Compromise
- Files appearing in the SiYuan assets/ directory whose original paths point outside the workspace, such as SSH keys, cloud credential files, or browser profile data.
- MCP tool invocation logs showing asset.upload calls with absolute paths containing .., /home/, /root/, /etc/, C:\Users\, or %USERPROFILE%.
- Unexpected outbound sharing or export activity referencing newly created asset files.
Detection Strategies
- Audit SiYuan MCP request logs for asset.upload calls whose path argument is absolute or resolves outside the workspace root.
- Monitor filesystem access by the SiYuan process for reads of sensitive files such as id_rsa, .aws/credentials, or .env files.
- Inspect AI Agent conversation transcripts for prompt-injection patterns that instruct the agent to upload local files by absolute path.
Monitoring Recommendations
- Enable verbose MCP logging on SiYuan and forward logs to a centralized platform for correlation.
- Alert on any process-level read of well-known credential file paths by the SiYuan binary.
- Track version and patch status of SiYuan instances across the environment to confirm remediation.
How to Mitigate CVE-2026-82233
Immediate Actions Required
- Upgrade SiYuan to v3.8.1 or later on all endpoints and servers.
- Disable the asset.upload MCP tool, or the MCP interface entirely, until the upgrade is applied.
- Rotate any credentials, SSH keys, or tokens that were readable by the SiYuan process during exposure.
- Review the workspace assets/ directory for files copied from outside the workspace and remove them.
Patch Information
The vulnerability is fixed in SiYuan v3.8.1. The patched release enforces workspace boundary validation on the asset.upload MCP tool so that only paths within the workspace root are accepted. Refer to the GitHub Security Advisory GHSA-p23f-cm6q-2qp8 for release notes and remediation guidance.
Workarounds
- Restrict the SiYuan process to a dedicated, unprivileged user account with no access to sensitive files elsewhere on the host.
- Run SiYuan inside a container or sandbox that only mounts the workspace directory, blocking access to credential files.
- Constrain AI Agents connected to SiYuan so that they cannot process untrusted external content likely to carry prompt injection payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
