SiYuan CVE-2026-74798

Exploitation requires an authenticated MCP client with permission to invoke the database_clean tool (CVSS PR:H), and the SiYuan kernel/MCP interface must be reachable by the attacker - the vector is AV:N so it can be network-reachable, but access to the privileged MCP tool surface is the gating prerequisite. The specific trigger is supplying path-traversal sequences (e.g. '../') in the id parameter of database_clean, which is passed to RemoveUnusedAttributeView without node-ID format validation. Impact is bounded to files readable by the SiYuan process account, so least-privilege deployment limits what can be read or deleted. Limiting factors: only affects versions before v3.7.4; requires MCP to be enabled and exposed; and requires the caller to already hold authenticated/privileged MCP access rather than being anonymously reachable.

The signals are largely consistent and point to a genuine high-severity issue for anyone exposing SiYuan's MCP interface: the CVSS 4.0 base score is 9.3 with VC:H/VI:H and subsequent-system SC:H/SI:H reflecting both arbitrary read and destructive deletion. Crucially the vector carries PR:H, so exploitation requires an already-authenticated/privileged MCP client - this is not an unauthenticated internet drive-by, which meaningfully lowers real-world exposure and argues the 9.3 overstates risk for typical single-user desktop installs. There is no EPSS score, POC, or KEV entry in the provided data, so probability-of-exploitation and active-exploitation signals are simply absent rather than reassuringly low; treat the risk as credible-but-unproven. The most realistic threat model is a shared, multi-tenant, or agent-driven deployment where an MCP client is reachable by a lower-trust party, or where a compromised/prompt-injected AI agent already holds MCP access and can be steered into invoking database_clean. Given the destructive delete primitive, operators running SiYuan as a networked service should patch promptly even though desktop-only users face materially lower urgency.

An attacker who already has authenticated access to the SiYuan MCP endpoint - for example a low-trust user on a shared instance, or an AI agent that has been prompt-injected - invokes the database_clean tool with an id value containing '../' traversal sequences pointing at a sensitive file such as a config, key, or credential store readable by the kernel process. The kernel copies that file into its history directory (yielding arbitrary read) and deletes the original (arbitrary deletion). No POC is published in the available data, and the AC:L/AT:N vector indicates the traversal is straightforward to trigger once MCP access is held.