{"id":"CVE-2026-60083","kind":"vulnerability","aliases":["CVE-2026-60083","GHSA-c8r8-95hg-mp34"],"related":[],"title":"SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files","description":"## Summary\n\n`kernel/mcp/tools/file.go`'s `resolvePath()` includes an explicit comment stating its\nsensitive-path blocklist is meant to align with the HTTP file API's established blacklist\n(`refuseToAccess()` in `kernel/api/file.go`), following the remediation for GHSA-cvhv-7xhj-xjp8\n(\"Unauthenticated Administrator takeover exfiltrated via the MCP\"), which specifically\nrecommended restricting this tool's scope. In practice, the MCP tool implements only 1 of the\n4 static blocklist entries the HTTP API enforces.\n\n## Comparison\n\n`kernel/api/file.go` `refuseToAccess()` blocks:\n1. `conf/conf.json` (API token, cookie signing key, accessAuthCode)\n2. `data/snippets/conf.json`\n3. the entire `data/templates` directory\n4. `data/.siyuan/publishAccess.json`\n5. (dynamic, per-request) any path the current publish-mode session isn't authorized for\n\n`kernel/mcp/tools/file.go` `resolvePath()` blocks only:\n```go\nconfPath := filepath.Join(util.ConfDir, \"conf.json\")\nif abs == confPath {\n    return \"\", fmt.Errorf(\"access to conf.json is forbidden\")\n}\n```\nItems 2, 3, and 4 are absent. The tool's own `list`/`read`/`grep`/`find` actions remain fully\nfunctional against them.\n\n## Impact\n\nAn MCP client with access to the `file` tool (post-fix for GHSA-cvhv-7xhj-xjp8, i.e. a properly\nauthenticated Administrator-level caller) can read `data/.siyuan/publishAccess.json` directly:\n\n```go\ntype PublishAccessItem struct {\n    ID       string `json:\"id\"`\n    Visible  bool   `json:\"visible\"`\n    Password string `json:\"password\"` // plaintext; empty string = no password\n    Disable  bool   `json:\"disable\"`\n}\n```\n\nThis exposes the plaintext access password for every publish-mode-shared notebook/document,\nletting the reader bypass password protection on any publish-mode share. This is a serious\nsibling issue given the volume of publish-mode access-control bugs already reported against this\ncodebase — the passwords protecting exactly that feature are directly readable through a tool\nwhose own description says \"never use for workspace data.\"\n\n`data/templates` and `data/snippets/conf.json` are lower-severity but still inconsistent with\nthe HTTP API's own precedent for what counts as sensitive.\n\n## Why this is a distinct finding, not a duplicate\n\nGHSA-cvhv-7xhj-xjp8 was about *reachability* an unauthenticated Reader-tier JWT being forwarded\nto admin-scoped paths including `/mcp`. That has been fixed. This report is about the *tool's own\nscope* once reached by a legitimate, properly-authenticated caller, the remediation notes for\nthat same advisory explicitly called for restricting `resolvePath` to\n`WorkspaceDir/temp/siyuan/*.log`, which was not implemented; instead the tool retains\nworkspace-wide scope with only a single-file blocklist addition.\n\n## Suggested fix\n\nEither replicate the full `refuseToAccess()` blocklist in `resolvePath()` (minimum fix, keeps\nparity with the HTTP API going forward by extracting `refuseToAccess`'s path list into a shared\nhelper both call), or implement the originally-recommended allowlist restricting the tool to\n`WorkspaceDir/temp/siyuan/*.log` for read and disabling write/delete/rename/copy entirely unless\nthe caller is Administrator, matching the tool's own advertised \"debugging/log reading only\"\nscope.","summary":"The SiYuan MCP file tool blocks only conf/conf.json, while the HTTP file API also blocks data/snippets/conf.json, data/templates and data/.siyuan/publishAccess.json. An authenticated Administrator-level MCP client can read the plaintext publish-mode passwords in publishAccess.json.","severity":"medium","cvss":6.9,"epss":0.00391,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/siyuan-note/siyuan/kernel","fixed":["0.0.0-20260808051406-3542530c505f"],"affected":"< 0.0.0-20260808051406-3542530c505f","ecosystem":"go"}],"ecosystems":["go"],"tags":["ai-tooling","cwe-863","go","mcp","self-hosted","siyuan"],"not_affected_if":["mcp-disabled","no-admin-mcp-clients","publish-mode-unused"],"how_to_check":"- Check the SiYuan kernel version with `go list -m github.com/siyuan-note/siyuan/kernel` or the release tag in use\n- Confirm whether the MCP server is enabled in the SiYuan deployment and who holds an Administrator token","fix":"- Upgrade the SiYuan kernel to `0.0.0-20260808051406-3542530c505f` or later\n- Rotate publish-mode share passwords if an untrusted MCP client could have read `data/.siyuan/publishAccess.json`","status":"open","published_at":"2026-08-22T13:16:39+00:00","first_seen_at":"2026-10-27T14:47:35+00:00","triaged_at":"2026-10-27T14:49:35+00:00","updated_at":"2026-10-27T15:02:22+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T14:49:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the SiYuan kernel to `0.0.0-20260808051406-3542530c505f` or later\n- Rotate publish-mode share passwords if an untrusted MCP client could have read `data/.siyuan/publishAccess.json`","reach":"network","title":"SiYuan: MCP file tool skips sensitive files blocked by the HTTP API","impact":"medium","summary":"The SiYuan MCP file tool blocks only conf/conf.json, while the HTTP file API also blocks data/snippets/conf.json, data/templates and data/.siyuan/publishAccess.json. An authenticated Administrator-level MCP client can read the plaintext publish-mode passwords in publishAccess.json.","category":"ai-tooling","nicknames":[],"who_cares":["siyuan","mcp","self-hosted","go"],"confidence":0.8,"needs_auth":"yes","worst_case":"Publish-mode share passwords are read in plaintext from workspace files","analyst_note":"","how_to_check":"- Check the SiYuan kernel version with `go list -m github.com/siyuan-note/siyuan/kernel` or the release tag in use\n- Confirm whether the MCP server is enabled in the SiYuan deployment and who holds an Administrator token","needs_analyst":false,"not_affected_if":["mcp-disabled","publish-mode-unused","no-admin-mcp-clients"],"who_is_affected":"Teams running SiYuan with the MCP server enabled and an MCP client that holds Administrator-level credentials can read publish-mode passwords through the file tool. Installations without MCP exposure, or where only trusted operators hold admin tokens, face little practical risk. Installations that do not use publish mode have nothing to protect there.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00078,"input_tokens":4595,"output_tokens":640,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':31A,39A '-60083':32A,40A '-863':48B '/mcp':417C '/siyuan-note/siyuan/kernel':43A '1':151C,166C '2':174C,220C '3':176C,221C '4':154C,181C,223C '5':183C '7xhj':127C,257C,398C '95hg':36A 'ab':210C 'absent':225C 'access':214C,245C,300C,335C 'access-control':334C 'accessauthcod':173C 'action':234C 'addit':474C 'admin':413C 'admin-scop':412C 'administr':77B,130C,264C,530C 'administrator-level':76B,263C 'advertis':536C 'advisori':446C 'ai':45B 'ai-tool':44B 'align':18A,108C 'allowlist':513C 'alreadi':338C 'also':68B 'api':14A,67B,113C,160C,168C,377C,492C 'authent':75B,262C,438C 'author':198C 'blacklist':116C 'block':60B,69B,165C,202C 'blocklist':6A,104C,156C,473C,482C 'bool':280C,293C 'bug':337C 'bypass':312C 'c8r8':35A 'call':448C,506C 'caller':266C,439C,528C 'claim':16A 'client':80B,243C 'codebas':342C 'comment':98C 'comparison':162C 'conf.json':208C,216C 'conf/conf.json':62B,167C 'confpath':205C,211C 'control':336C 'cooki':170C 'count':383C 'current':191C 'cve':30A,38A 'cvhv':126C,256C,397C 'cwe':47B 'data':363C 'data/.siyuan/publishaccess.json':73B,182C,269C 'data/snippets/conf.json':70B,175C,366C 'data/templates':71B,179C,364C 'debugging/log':537C 'descript':357C 'direct':270C,350C 'directori':180C 'disabl':292C,295C,523C 'distinct':390C 'duplic':394C 'dynam':184C 'either':477C 'empti':288C 'enforc':161C 'entir':178C,525C 'entri':157C 'establish':115C 'everi':303C 'exact':346C 'exfiltr':132C 'explicit':97C,447C 'expos':20A,297C 'extract':496C 'featur':348C 'file':3A,13A,29A,58B,66B,112C,248C,472C 'filepath.join':206C 'find':233C,391C 'fix':252C,421C,476C,486C 'fmt.errorf':213C 'follow':120C 'forbidden':218C 'forward':410C,494C 'full':480C 'fulli':236C 'function':237C 'ghsa':34A,125C,255C,396C 'ghsa-c8r8-95hg-mp34':33A 'ghsa-cvhv-7xhj-xjp8':124C,254C,395C 'github.com':42A 'github.com/siyuan-note/siyuan/kernel':41A 'given':327C 'go':49B,204C,271C,493C 'grep':232C 'helper':504C 'host':53B 'http':12A,65B,111C,159C,376C,491C 'i.e':259C 'id':275C,278C 'impact':240C 'implement':149C,458C,508C 'includ':95C,416C 'incomplet':8A 'inconsist':373C 'instead':459C 'isn':196C 'issu':326C 'item':219C 'json':277C,281C,285C,294C 'jwt':408C 'keep':487C 'kernel/api/file.go':119C,163C 'kernel/mcp/tools/file.go':92C,200C 'key':172C 'legitim':435C 'let':309C 'level':78B,265C 'list':230C,500C 'log':454C,519C 'lower':369C 'lower-sever':368C 'match':531C 'mcp':2A,50B,57B,79B,135C,147C,242C 'meant':106C 'minimum':485C 'mode':23A,87B,194C,306C,319C,333C 'mp34':37A 'never':359C 'note':442C 'notebook/document':308C 'origin':511C 'originally-recommend':510C 'pariti':488C 'password':24A,88B,283C,286C,291C,301C,313C,344C 'path':103C,189C,415C,499C 'per':186C 'per-request':185C 'plaintext':84B,287C,299C 'post':251C 'post-fix':250C 'practic':145C 'preced':380C 'proper':261C,437C 'properly-authent':436C 'protect':314C,345C 'publish':22A,86B,193C,305C,318C,332C 'publish-mod':21A,85B,192C,317C,331C 'publish-mode-shar':304C 'publishaccess.json':90B 'publishaccessitem':273C 'reach':432C 'reachabl':402C 'read':82B,231C,268C,521C,538C 'readabl':351C 'reader':311C,406C 'reader-ti':405C 'recommend':138C,512C 'refusetoaccess':117C,164C,481C,497C 'relat':9A 'remain':235C 'remedi':122C,441C 'replic':478C 'report':339C,423C 'request':187C 'resolvepath':94C,201C,451C,484C 'restrict':139C,450C,514C 'retain':462C 'return':212C 'say':358C 'scope':143C,414C,430C,466C,540C 'self':52B 'self-host':51B 'sensit':27A,102C,385C 'sensitive-path':101C 'serious':324C 'session':195C 'sever':370C 'share':307C,320C,503C 'sibl':325C 'sign':171C 'singl':471C 'single-fil':470C 'siyuan':1A,54B,56B 'specif':137C 'state':99C 'static':155C 'still':372C 'string':276C,284C,289C 'struct':274C 'suggest':475C 'summari':91C 'takeov':131C 'tier':407C 'token':169C 'tool':4A,46B,59B,141C,148C,227C,249C,354C,427C,461C,516C,533C 'type':272C 'unauthent':129C,404C 'unless':526C 'use':360C 'util.confdir':207C 'via':133C 'visibl':279C,282C 'volum':329C 'whose':355C 'wide':465C 'workspac':28A,362C,464C 'workspace-wid':463C 'workspacedir/temp/siyuan':453C,518C 'write/delete/rename/copy':524C 'xjp8':128C,258C,399C","nicknames":[],"mitigations":[],"who_affected":"Teams running SiYuan with the MCP server enabled and an MCP client that holds Administrator-level credentials can read publish-mode passwords through the file tool. Installations without MCP exposure, or where only trusted operators hold admin tokens, face little practical risk. Installations that do not use publish mode have nothing to protect there.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-22T13:16:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-c8r8-95hg-mp34","url":"https://github.com/advisories/GHSA-c8r8-95hg-mp34","severity":"medium","published_at":"2026-10-27T14:43:57+00:00","modified_at":"2026-10-27T14:43:58+00:00","first_seen_at":"2026-10-27T14:47:35+00:00","fetched_at":"2026-10-27T14:47:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-60083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60083","severity":null,"published_at":"2026-08-22T13:16:39+00:00","modified_at":"2026-10-12T16:10:00+00:00","first_seen_at":"2026-10-27T15:02:22+00:00","fetched_at":"2026-10-27T15:02:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}