MEDIUM 4.9 GitHub
CVE-2026-60083
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive works
## Summary
`kernel/mcp/tools/file.go`'s `resolvePath()` includes an explicit comment stating its
sensitive-path blocklist is meant to align with the HTTP file API's established blacklist
(`refuseToAccess()` in `kernel/api/file.go`), following the remediation for GHSA-cvhv-7xhj-xjp8
("Unauthenticated Administrator takeover exfiltrated via the MCP"), which specifically
recommended restricting this tool's scope. In practice, the MCP tool implements only 1 of the
4 static blocklist entries the HTTP
Affected Products
- go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260808051406-3542530c505f
References
- https://github.com/advisories/GHSA-c8r8-95hg-mp34
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34
- https://nvd.nist.gov/vuln/detail/CVE-2026-60083
- https://github.com/siyuan-note/siyuan/commit/3542530c505f13aa3fbd0343627409ca6c000dd2
This medium severity vulnerability with a CVSS score of 4.9 was published on 2026-10-27 via GitHub. Affected: go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260808051406-3542530c505f.
vulnfeed aggregates 18943 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.