---
id: "CVE-2026-116168"
kind: "vulnerability"
aliases: ["CVE-2026-116168"]
title: "SiYuan: MCP asset upload lets authenticated users copy secret files"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mcp", "package", "self-hosted", "siyuan"]
not_affected_if: ["mcp-disabled", "patched-version"]
published_at: "2026-10-25T14:16:55+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:42:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116168", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# SiYuan: MCP asset upload lets authenticated users copy secret files

SiYuan before 3.8.7 has an incomplete blacklist of sensitive paths in its MCP asset upload tool, so it omits files such as .env. An authenticated attacker can copy those local files into the workspace and read them back over the /assets/ HTTP path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SiYuan version; affected builds are those before `3.8.7`.
- Check whether the MCP asset upload action is enabled on the instance.

## Fix

- Upgrade SiYuan to `3.8.7` or later.
- Rotate any secrets, such as `.env` values, that were stored on a host running a vulnerable build and reachable through the MCP asset tool.

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116168

## From the sources

SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_