Live › vulnerability › CVE-2026-116168
Go to dashboardSiYuan before 3.8.7 has an incomplete blacklist of sensitive paths in its MCP asset upload tool, so it omits files such as .env. An authenticated attacker can copy those local files into the workspace and read them back over the /assets/ HTTP path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams running SiYuan self-hosted before 3.8.7 where MCP access is available to user accounts. Exposure depends on an attacker holding valid credentials and being able to drive the MCP asset upload action. Installs on 3.8.7 or later are not affected.
No product ranges from the sources yet.
3.8.7.3.8.7 or later..env values, that were stored on a host running a vulnerable build and reachable through the MCP asset tool.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.
This page as .md · .json · in your agent: get_signal("CVE-2026-116168")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.