SiYuan CVE-2026-116168

Requires (1) SiYuan's agent-facing MCP server to be enabled and reachable, (2) the attacker to drive an agent/MCP client authenticated with a valid SiYuan API token (Conf.Api.Token, an agent/admin principal - the advisory PoC used a Bearer token), and (3) invocation of the asset tool's 'upload' action with a 'files' path. The read is bounded to local files on the server host whose names are NOT on the 17-entry dotfile blacklist - concretely ~/.env, .env.local, .env.production and similar, plus the other documented omissions ~/Library/** (macOS Keychain), other users' home directories (/home/<otheruser>/), and Windows %APPDATA%/%LOCALAPPDATA%. Limiting factors: authentication to the MCP surface is required, the MCP asset tool must be exposed, only confidentiality is affected (no write/integrity or availability impact), and files already covered by the blacklist (.ssh, .aws, .kube, .docker, .gnupg, .git-credentials, credentials*, id_*) remain blocked.

This is a moderate, not emergency, priority. The input CVSS 4.0 base score is 6.9 (Medium) with a local attack vector (AV:L), low complexity (AC:L), no attack requirements (AT:N), and confidentiality-only impact (VC:H, VI:N, VA:N, no subsequent-system impact). The vuln.today decision label is 'this_month', consistent with a Medium, confidentiality-only, authentication-gated flaw rather than an act_now/emergency item. No EPSS score and no CISA KEV listing were provided, so there is no signal of active or widespread exploitation - treat exploitation status as 'no public exploit identified' in the KEV/active sense, but note that the GHSA advisory itself documents a fully executed lab PoC (a public PoC reference exists; it is not verified as packaged, working exploit code). A key conflict: the supplied CVSS 4.0 vector contains PR:N (unauthenticated), yet the advisory's own PoC drives the MCP endpoint with a valid Bearer API token (Conf.Api.Token, an agent/admin principal) and the description explicitly says 'Authenticated attackers' - so the PR:N metric appears inconsistent with the documented trigger; verify authentication requirements with the vendor. Net: a real but bounded issue - it requires the MCP asset surface and a valid token, impacts confidentiality only, and affects a niche product, so it ranks below internet-facing unauthenticated RCE despite a Medium CVSS.

An adversary able to drive an agent that is connected to a SiYuan instance's MCP server (the same threat model as the parent advisory GHSA-p23f-cm6q-2qp8) and holding a valid API token invokes the asset tool's 'upload' action with a path such as /home/siyuan/.env. The incomplete sensitive-path blacklist in validateAssetUploadPaths accepts the path, the server copies the file into data/assets/ under a generated name, and the attacker then retrieves the secret contents via an authenticated GET /assets/<name> request. A working PoC against SiYuan v3.8.6 (Docker b3log/siyuan) is documented step-by-step in the GHSA advisory, so the attack is proven rather than theoretical.