SiYuan CVE-2026-100633

Requires an authenticated SiYuan administrator (PR:H) operating versions 3.8.0 through 3.8.3 with the MCP file tool reachable either via the in-app Agent or an external MCP server. The core defect: util.IsForbiddenAbsPath() is checked only against the allowed root of a recursive operation, not against each resolved descendant, so file.grep, file.copy, and unzip reach protected non-hidden descendants (conf/conf.json, TLS keys, data/snippets/conf.json, data/templates/, data/.siyuan/publishAccess.json, notebook .siyuan internals, kernel log). Limiting factors: administrative authentication is mandatory; file.copy-then-read and unzip require the actor to choose lexically contained target/member names; only file.grep runs without a confirmation card. The practical risk amplifier is agentic/prompt-injection abuse, since file.grep is classified as a safe action and confirmation cards for copy/unzip hide the real descendant paths. Fixed in 3.8.4.

The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N) scores 8.5, but the PR:H requirement materially constrains real-world risk: exploitation requires an already-authenticated administrator, and SiYuan is a single-user, self-hosted personal knowledge tool where the admin is typically the sole operator. The more credible threat is not privilege escalation by a low-privileged user but rather agentic abuse - prompt injection or a malicious MCP client steering the in-app Agent to invoke file.grep/file.copy/unzip against protected descendants, made stealthy by the fact that file.grep is globally classified as 'safe' (no per-call confirmation) and the confirmation cards for file.copy/unzip display only the allowed root, hiding the actual descendant targets. EPSS, CISA KEV, and public POC signals are all absent, indicating no evidence of active or automated exploitation; this is a genuine authorization-guard defect rather than a mass-exploited flaw. CWE-863 (Incorrect Authorization) is accurate - the sensitive-path denylist is simply not re-applied to each resolved descendant, an explicitly incomplete fix for prior GHSA-c8r8-95hg-mp34. Priority is moderate: real confidentiality/integrity exposure of TLS keys, config, and templates, but gated behind admin authority.

An authenticated SiYuan administrator - or an LLM agent driven by injected instructions through the in-app Agent or an external MCP server - issues a recursive file.grep whose allowed root passes the guard but whose descendants include conf/conf.json or TLS private keys, returning matching lines with no confirmation prompt. Alternatively the actor uses file.copy to relocate a protected descendant (e.g. data/.siyuan/publishAccess.json) to an ordinary path and then file.read to retrieve it, or uses unzip to overwrite a protected descendant via a lexically contained ZIP member name. No public exploit code is identified at time of analysis.