CVE-2026-85580 Overview
CVE-2026-85580 is a path guard bypass vulnerability in SiYuan, an open-source personal knowledge management application. The flaw exists in the Model Context Protocol (MCP) file-access handler in SiYuan versions before v3.8.2. The handler performs case-sensitive matching when validating requested paths, which conflicts with the case-sensitive semantics of Linux filesystems. Attackers can request case-variant paths such as PublishAccess.json instead of publishAccess.json to bypass the guard and read protected configuration data. Successful exploitation discloses publish-access configuration and metadata stored in the file. The vulnerability is tracked under [CWE-22] Path Traversal.
Critical Impact
Authenticated remote attackers can bypass the MCP file-access guard using case-variant path requests to read the protected publishAccess.json file and disclose sensitive publish-access configuration.
Affected Products
- SiYuan versions prior to v3.8.2
- SiYuan MCP file-access handler component
- Linux deployments of SiYuan (case-sensitive filesystems)
Discovery Timeline
- 2026-09-04 - CVE-2026-85580 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-85580
Vulnerability Analysis
SiYuan exposes an MCP interface that includes a file-access handler for retrieving application resources. The handler enforces a deny list to prevent clients from reading sensitive configuration files, including publishAccess.json. This file stores publish-access configuration and metadata used to control published content permissions.
The guard compares the requested path against protected filenames using case-sensitive string matching. On Linux, filesystem lookups are also case-sensitive, but the guard fails to normalize the input before comparison. An attacker who submits a request with altered casing, such as PublishAccess.json or PUBLISHACCESS.JSON, avoids the deny-list match. However, on filesystems that resolve case-insensitively or through symbolic aliases, the underlying read still succeeds. The result is disclosure of protected file contents without triggering the guard.
Root Cause
The root cause is inconsistent path canonicalization between the security check and the file access operation. The MCP handler validates the path using a case-sensitive comparison but does not lowercase the input or resolve it to a canonical form before checking the deny list. This is a classic case-mismatch path traversal weakness classified under [CWE-22].
Attack Vector
Exploitation requires network access to the SiYuan MCP endpoint and low-privilege authenticated access. The attacker issues an MCP file-access request that references the target configuration file using non-standard casing. The guard permits the request because the case-altered string does not match the protected entry. The handler then reads and returns the file contents. No user interaction is required, and the attack complexity is low.
The vulnerability is described in prose only; refer to the GitHub Security Advisory GHSA-mmgw-3mx9-cfwp and the VulnCheck Advisory for Siyuan Bypass for further technical detail.
Detection Methods for CVE-2026-85580
Indicators of Compromise
- MCP file-access requests referencing publishAccess.json with non-standard casing such as PublishAccess.json, PUBLISHACCESS.JSON, or mixed-case variants.
- Successful HTTP responses returning JSON content that matches the schema of publishAccess.json to unexpected clients.
- Access log entries showing repeated file-access probes iterating through case permutations of protected filenames.
Detection Strategies
- Instrument the MCP file-access handler to log every file read request with the raw requested path and the resolved canonical path for comparison.
- Alert when access log entries contain protected filenames in any casing other than the canonical lowercase form used by the application.
- Correlate MCP file-access activity with authenticated session identity to identify low-privileged accounts probing configuration paths.
Monitoring Recommendations
- Forward SiYuan application and web server access logs to a centralized log platform and retain them for post-incident review.
- Monitor read access to publishAccess.json and other configuration files stored in the SiYuan working directory.
- Track outbound responses from the MCP endpoint for payload sizes and content types consistent with configuration file disclosure.
How to Mitigate CVE-2026-85580
Immediate Actions Required
- Upgrade SiYuan to version v3.8.2 or later, which fixes the case-mismatch path guard bypass.
- Inventory all SiYuan deployments, prioritizing Linux hosts and any instance exposing the MCP endpoint beyond localhost.
- Rotate any secrets, tokens, or publish-access credentials that may have been exposed through publishAccess.json prior to patching.
Patch Information
The issue is resolved in SiYuan v3.8.2. Administrators should upgrade to this release or later. See the GitHub Security Advisory GHSA-mmgw-3mx9-cfwp for release notes and the VulnCheck Advisory for Siyuan Bypass for additional remediation guidance.
Workarounds
- Restrict network exposure of the SiYuan MCP endpoint to trusted hosts only, using a reverse proxy or host firewall.
- Require strong authentication for MCP access and revoke unused accounts that could be used to reach the file-access handler.
- Apply filesystem-level permissions so that only the SiYuan process user can read publishAccess.json, and consider moving sensitive configuration outside the served directory where feasible.
# Configuration example: restrict access to the SiYuan MCP endpoint at the reverse proxy
# and tighten permissions on the protected configuration file
chmod 600 /path/to/siyuan/conf/publishAccess.json
chown siyuan:siyuan /path/to/siyuan/conf/publishAccess.json
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
