{"id":"GHSA-p23f-cm6q-2qp8","kind":"vulnerability","aliases":["GHSA-p23f-cm6q-2qp8","GO-2026-6655"],"related":[],"title":"SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel","description":"SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel","summary":"The SiYuan kernel's MCP asset.upload tool accepts absolute file paths without restricting them to the workspace. An attacker who can call that tool can read arbitrary files the SiYuan process can access on the host.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/siyuan-note/siyuan/kernel","fixed":["0.0.0-20260813142104-b26a4a307b8a"],"affected":"< 0.0.0-20260813142104-b26a4a307b8a","ecosystem":"go"}],"ecosystems":["go"],"tags":["ai-tooling","go","mcp","self-hosted","siyuan"],"not_affected_if":["managed-hosting","mcp-disabled"],"how_to_check":"Run go list -m github.com/siyuan-note/siyuan/kernel in the project that builds SiYuan and compare the version to 0.0.0-20260813142104-b26a4a307b8a. Check whether the MCP server is enabled in the SiYuan deployment.","fix":"Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260813142104-b26a4a307b8a or later. Restrict MCP access until the upgrade is done.","status":"open","published_at":"2026-10-07T14:10:14+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:57:05+00:00","updated_at":"2026-10-23T20:57:05+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-23T20:57:05Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260813142104-b26a4a307b8a or later. Restrict MCP access until the upgrade is done.","reach":"unknown","impact":"high","summary":"The SiYuan kernel's MCP asset.upload tool accepts absolute file paths without restricting them to the workspace. An attacker who can call that tool can read arbitrary files the SiYuan process can access on the host.","category":"ai-tooling","who_cares":["go","self-hosted","mcp","siyuan"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads arbitrary host files readable by the SiYuan process","analyst_note":"Confirm whether the MCP server requires an auth token and whether it is enabled by default, using the GHSA-p23f-cm6q-2qp8 advisory and https://pkg.go.dev/vuln/GO-2026-6655.","how_to_check":"Run go list -m github.com/siyuan-note/siyuan/kernel in the project that builds SiYuan and compare the version to 0.0.0-20260813142104-b26a4a307b8a. Check whether the MCP server is enabled in the SiYuan deployment.","needs_analyst":true,"not_affected_if":["mcp-disabled","managed-hosting"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00087,"input_tokens":2888,"output_tokens":1162,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':22A '-6655':23A '/siyuan-note/siyuan/kernel':15A,31A,91C '2qp8':20A,28A 'absolut':6A,49B,82C 'accept':48B 'access':73B 'ai':33B 'ai-tool':32B 'arbitrari':5A,67B,81C 'asset.upload':3A,46B,79C 'attack':59B 'boundari':10A,86C 'bypass':11A,87C 'call':62B 'cm6q':19A,27A 'file':7A,50B,68B,83C 'ghsa':17A,25A 'ghsa-p23f-cm6q-2qp8':16A,24A 'github.com':14A,30A,90C 'github.com/siyuan-note/siyuan/kernel':13A,29A,89C 'go':21A,35B 'host':39B,76B 'kernel':43B 'mcp':2A,36B,45B,78C 'p23f':18A,26A 'path':8A,51B,84C 'process':71B 'read':4A,66B,80C 'restrict':53B 'self':38B 'self-host':37B 'siyuan':1A,40B,42B,70B,77C 'tool':34B,47B,64B 'without':52B 'workspac':9A,57B,85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T14:10:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6655","url":"https://pkg.go.dev/vuln/GO-2026-6655","severity":null,"published_at":"2026-10-07T14:10:14+00:00","modified_at":"2026-10-07T14:10:14+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}