SiYuan EUVD-2026-71003

Exploitation requires a valid authenticated session at low-privilege level (PR:L per CVSS 4.0 vector). The vulnerability is Linux-specific: it only manifests on case-sensitive filesystems, so Windows or macOS deployments with case-insensitive filesystems are not affected. The SiYuan MCP file-access handler must be enabled and accessible (it is part of SiYuan's AI integration feature). The affected versions are all SiYuan releases before v3.8.2. Limiting factors include the requirement for prior authentication and the Linux-only filesystem dependency - deployments on Windows or macOS are not vulnerable regardless of version.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1, accurately capturing a network-accessible, low-complexity confidentiality breach requiring only a low-privilege authenticated session. No EPSS score is available in the supplied data, and the CVE is not listed in CISA KEV, suggesting no confirmed active exploitation at this time. Real-world risk is narrowed by the Linux-specific nature of the bypass and the PR:L requirement - the attacker must already hold a valid session. The exposed file (publishAccess.json) contains publish-access credentials and configuration metadata, which could be leveraged for secondary account compromise or lateral movement within a SiYuan-integrated AI workflow. Even a mid-sized municipal IT team in gniezno that self-hosts SiYuan for internal documentation should treat this as urgent given how trivially the guard is bypassed once authenticated. Impact is limited to confidentiality - no integrity or availability effects are identified.

An authenticated attacker with a low-privilege SiYuan session sends an HTTP request to the MCP file-access handler using a case-variant path such as /api/file/PublishAccess.json (capitalizing one or more characters). The path guard's string comparison fails to match its protected-filename list and allows the request through, while the Linux filesystem resolves it to the actual publishAccess.json file and returns its contents. The attacker extracts publish-access credentials from the response, potentially enabling further unauthorized access to connected services or AI integrations.