CVE-2026-60083 - SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool
Brief
CVE ID : CVE-2026-60083
Published : Aug. 22, 2026, 12:26 p. m.
- 44 minutes ago
Description : SiYuan versions before v3.
- 0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/. siyuan/publishAccess. json and access other sensitive files like data/templates and data/snippets/conf. json.
Severity: 6.9
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...