{"id":"CVE-2026-60083","aliases":["GHSA-c8r8-95hg-mp34"],"url":"https://o3.security/vulnerability/CVE-2026-60083","summary":"SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool","details":"## Summary\n\n`kernel/mcp/tools/file.go`'s `resolvePath()` includes an explicit comment stating its\nsensitive-path blocklist is meant to align with the HTTP file API's established blacklist\n(`refuseToAccess()` in `kernel/api/file.go`), following the remediation for GHSA-cvhv-7xhj-xjp8\n(\"Unauthenticated Administrator takeover exfiltrated via the MCP\"), which specifically\nrecommended restricting this tool's scope. In practice, the MCP tool implements only 1 of the\n4 static blocklist entries the HTTP API enforces.\n\n## Comparison\n\n`kernel/api/file.go` `refuseToAccess()` blocks:\n1. `conf/conf.json` (API token, cookie signing key, accessAuthCode)\n2. `data/snippets/conf.json`\n3. the entire `data/templates` directory\n4. `data/.siyuan/publishAccess.json`\n5. (dynamic, per-request) any path the current publish-mode session isn't authorized for\n\n`kernel/mcp/tools/file.go` `resolvePath()` blocks only:\n```go\nconfPath := filepath.Join(util.ConfDir, \"conf.json\")\nif abs == confPath {\n    return \"\", fmt.Errorf(\"access to conf.json is forbidden\")\n}\n```\nItems 2, 3, and 4 are absent. The tool's own `list`/`read`/`grep`/`find` actions remain fully\nfunctional against them.\n\n## Impact\n\nAn MCP client with access to the `file` tool (post-fix for GHSA-cvhv-7xhj-xjp8, i.e. a properly\nauthenticated Administrator-level caller) can read `data/.siyuan/publishAccess.json` directly:\n\n```go\ntype PublishAccessItem struct {\n    ID       string `json:\"id\"`\n    Visible  bool   `json:\"visible\"`\n    Password string `json:\"password\"` // plaintext; empty string = no password\n    Disable  bool   `json:\"disable\"`\n}\n```\n\nThis exposes the plaintext access password for every publish-mode-shared notebook/document,\nletting the reader bypass password protection on any publish-mode share. This is a serious\nsibling issue given the volume of publish-mode access-control bugs already reported against this\ncodebase — the passwords protecting exactly that feature are directly readable through a tool\nwhose own description says \"never use for workspace data.\"\n\n`data/templates` and `data/snippets/conf.json` are lower-severity but still inconsistent with\nthe HTTP API's own precedent for what counts as sensitive.\n\n## Why this is a distinct finding, not a duplicate\n\nGHSA-cvhv-7xhj-xjp8 was about *reachability* an unauthenticated Reader-tier JWT being forwarded\nto admin-scoped paths including `/mcp`. That has been fixed. This report is about the *tool's own\nscope* once reached by a legitimate, properly-authenticated caller, the remediation notes for\nthat same advisory explicitly called for restricting `resolvePath` to\n`WorkspaceDir/temp/siyuan/*.log`, which was not implemented; instead the tool retains\nworkspace-wide scope with only a single-file blocklist addition.\n\n## Suggested fix\n\nEither replicate the full `refuseToAccess()` blocklist in `resolvePath()` (minimum fix, keeps\nparity with the HTTP API going forward by extracting `refuseToAccess`'s path list into a shared\nhelper both call), or implement the originally-recommended allowlist restricting the tool to\n`WorkspaceDir/temp/siyuan/*.log` for read and disabling write/delete/rename/copy entirely unless\nthe caller is Administrator, matching the tool's own advertised \"debugging/log reading only\"\nscope.","published":"2026-08-22T12:26:36.709Z","modified":"2026-10-21T02:58:50.744114546Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","fixedVersion":"0.0.0-20260808051406-3542530c505f"}],"fix":{"url":"https://github.com/siyuan-note/siyuan/commit/3542530c505f13aa3fbd0343627409ca6c000dd2","label":"siyuan-note/siyuan@3542530"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60083.json"},{"type":"ADVISORY","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60083"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool"},{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/commit/3542530c505f13aa3fbd0343627409ca6c000dd2"},{"type":"PACKAGE","url":"https://github.com/siyuan-note/siyuan"},{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:50.744114546Z"}}