SiYuan CVE-2026-60083

Exploitation requires authentication as a SiYuan administrator - confirmed by the CVSS 4.0 vector metric PR:H. The MCP file tool must be accessible within the authenticated admin session. Credential exposure from publishAccess.json only materializes if the SiYuan publish feature has been configured and the file exists; instances that have never enabled publish mode are not exposed to that specific data. There is no unauthenticated path and no privilege escalation to the host OS - impact is confined to SiYuan workspace file confidentiality. Limiting factors include: admin credential requirement eliminates opportunistic external attackers; publish-mode configuration is non-default; and the affected data is scoped entirely within SiYuan's workspace.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N reflects the threat accurately. Network accessibility (AV:N) and low complexity (AC:L) are substantially offset by the hard requirement for administrator-level credentials (PR:H), making this vulnerability inaccessible to unauthenticated or low-privilege attackers. The confidentiality impact is genuinely high - plaintext password exposure from publishAccess.json can cascade into unauthorized access to published SiYuan workspaces - but integrity and availability are unaffected. No active exploitation is confirmed (not listed in CISA KEV) and no public POC is known, placing real-world exploitation risk in insider-threat or post-compromise scenarios. The net assessment is a real but constrained issue: meaningful if admin credentials are shared or reused, but not a priority over external-facing, unauthenticated vulnerabilities.

An authenticated SiYuan administrator - or an attacker who has obtained admin credentials through phishing, credential stuffing, or a separate compromise - invokes the MCP file tool targeting the path data/.siyuan/publishAccess.json. Because the blocklist in versions before v3.8.0 does not cover this path, the file is returned in plaintext, exposing the publish-mode password. The attacker then uses those credentials to authenticate to published SiYuan workspaces without additional authorization.