EUVD-2026-60081
GHSA-mwfp-66vr-j373
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
MCP access requires an authenticated privileged client (PR:H) but is network-reachable and easy to trigger (AV:N/AC:L); path traversal escapes the app's data scope (S:C) enabling arbitrary read (C:H) and deletion (I:H), with no direct availability impact modeled (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView (kernel/model/attribute_view.go), which builds a filesystem path via filepath.Join without validating that id matches SiYuan's node-ID format. An authenticated MCP client can supply path traversal sequences in id to cause the kernel to copy an arbitrary file readable by the process into SiYuan's history directory (arbitrary file read) and then delete the original file (arbitrary file deletion). The corresponding HTTP API handler was hardened in GHSA-7hm9-v7vf-7g4w, but this MCP caller was not.
AnalysisAI
Arbitrary file read and deletion in SiYuan kernel before v3.7.4 arises from an unvalidated id parameter in the database_clean MCP tool, letting an authenticated MCP client traverse the filesystem to copy any process-readable file into the history directory and then delete the original. This is the MCP-facing twin of a flaw previously fixed on the HTTP API path (GHSA-7hm9-v7vf-7g4w), meaning a known-bad code pattern survived in a second caller. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated MCP client with permission to invoke the database_clean tool (CVSS PR:H), and the SiYuan kernel/MCP interface must be reachable by the attacker - the vector is AV:N so it can be network-reachable, but access to the privileged MCP tool surface is the gating prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine high-severity issue for anyone exposing SiYuan's MCP interface: the CVSS 4.0 base score is 9.3 with VC:H/VI:H and subsequent-system SC:H/SI:H reflecting both arbitrary read and destructive deletion. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already has authenticated access to the SiYuan MCP endpoint - for example a low-trust user on a shared instance, or an AI agent that has been prompt-injected - invokes the database_clean tool with an id value containing '../' traversal sequences pointing at a sensitive file such as a config, key, or credential store readable by the kernel process. The kernel copies that file into its history directory (yielding arbitrary read) and deletes the original (arbitrary deletion). … |
| Remediation | Upgrade SiYuan to v3.7.4 or later, which applies the same path-validation hardening to the MCP database_clean caller that GHSA-7hm9-v7vf-7g4w previously applied to the HTTP API handler; a vendor patch is confirmed available per the advisory (https://github.com/siyuan-note/siyuan/security/advisories/GHSA-43jx-gxq4-jpjc). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all SiYuan kernel deployments and their current versions across your infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Reflected XSS in SiYuan knowledge management before 3.5.9.
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to
Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today