{"id":"CVE-2026-116168","kind":"vulnerability","aliases":["CVE-2026-116168"],"related":[],"title":"SiYuan: MCP asset upload lets authenticated users copy secret files","description":"SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.","summary":"SiYuan before 3.8.7 has an incomplete blacklist of sensitive paths in its MCP asset upload tool, so it omits files such as .env. An authenticated attacker can copy those local files into the workspace and read them back over the /assets/ HTTP path.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mcp","package","self-hosted","siyuan"],"not_affected_if":["mcp-disabled","patched-version"],"how_to_check":"- Check the installed SiYuan version; affected builds are those before `3.8.7`.\n- Check whether the MCP asset upload action is enabled on the instance.","fix":"- Upgrade SiYuan to `3.8.7` or later.\n- Rotate any secrets, such as `.env` values, that were stored on a host running a vulnerable build and reachable through the MCP asset tool.","status":"open","published_at":"2026-10-25T14:16:55+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:43+00:00","updated_at":"2026-10-25T14:42:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:42:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SiYuan to `3.8.7` or later.\n- Rotate any secrets, such as `.env` values, that were stored on a host running a vulnerable build and reachable through the MCP asset tool.","reach":"network","title":"SiYuan: MCP asset upload lets authenticated users copy secret files","impact":"medium","summary":"SiYuan before 3.8.7 has an incomplete blacklist of sensitive paths in its MCP asset upload tool, so it omits files such as .env. An authenticated attacker can copy those local files into the workspace and read them back over the /assets/ HTTP path.","category":"package","nicknames":[],"who_cares":["siyuan","self-hosted","mcp"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated attacker reads secret files such as .env over HTTP","analyst_note":"","how_to_check":"- Check the installed SiYuan version; affected builds are those before `3.8.7`.\n- Check whether the MCP asset upload action is enabled on the instance.","needs_analyst":false,"not_affected_if":["patched-version","mcp-disabled"],"who_is_affected":"Teams running SiYuan self-hosted before 3.8.7 where MCP access is available to user accounts. Exposure depends on an attacker holding valid credentials and being able to drive the MCP asset upload action. Installs on 3.8.7 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000601,"input_tokens":3348,"output_tokens":532,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116168':13A,16A '-2026':12A,15A '/assets':63B,117C '3.8.7':25B,68C 'action':103C 'asset':3A,36B,77C,101C 'attack':48B,97C 'authent':6A,47B,96C 'back':60B,115C 'blacklist':29B,88C 'contain':69C 'copi':8A,50B,105C 'cve':11A,14A 'drive':98C 'env':45B,91C 'file':10A,42B,53B,95C,108C 'host':21B 'http':64B,119C 'incomplet':28B,84C 'let':5A 'local':52B,107C 'mcp':2A,17B,35B,76C,100C 'omit':41B,90C 'packag':18B 'path':32B,65B,71C,87C 'read':58B,113C 'reli':81C 'secret':9A,94C 'self':20B 'self-host':19B 'sensit':31B,86C 'sensitive-path':85C 'siyuan':1A,22B,23B,66C 'tool':38B,78C 'travers':72C 'upload':4A,37B,102C 'user':7A 'validateassetuploadpath':80C 'via':116C 'vulner':73C 'workspac':56B,111C","nicknames":[],"mitigations":[],"who_affected":"Teams running SiYuan self-hosted before 3.8.7 where MCP access is available to user accounts. Exposure depends on an attacker holding valid credentials and being able to drive the MCP asset upload action. Installs on 3.8.7 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116168","severity":null,"published_at":"2026-10-25T14:16:55+00:00","modified_at":"2026-10-25T14:16:56+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}