{"schema":"threatline.record/2","record":{"id":"CVE-2026-60083","aliases":["GHSA-c8r8-95hg-mp34"],"summary":"SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files","details":"## Summary\n\n`kernel/mcp/tools/file.go`'s `resolvePath()` includes an explicit comment stating its\nsensitive-path blocklist is meant to align with the HTTP file API's established blacklist\n(`refuseToAccess()` in `kernel/api/file.go`), following the remediation for GHSA-cvhv-7xhj-xjp8\n(\"Unauthenticated Administrator takeover exfiltrated via the MCP\"), which specifically\nrecommended restricting this tool's scope. In practice, the MCP tool implements only 1 of the\n4 static blocklist entries the HTTP API enforces.\n\n## Comparison\n\n`kernel/api/file.go` `refuseToAccess()` blocks:\n1. `conf/conf.json` (API token, cookie signing key, accessAuthCode)\n2. `data/snippets/conf.json`\n3. the entire `data/templates` directory\n4. `data/.siyuan/publishAccess.json`\n5. (dynamic, per-request) any path the current publish-mode session isn't authorized for\n\n`kernel/mcp/tools/file.go` `resolvePath()` blocks only:\n```go\nconfPath := filepath.Join(util.ConfDir, \"conf.json\")\nif abs == confPath {\n    return \"\", fmt.Errorf(\"access to conf.json is forbidden\")\n}\n```\nItems 2, 3, and 4 are absent. The tool's own `list`/`read`/`grep`/`find` actions remain fully\nfunctional against them.\n\n## Impact\n\nAn MCP client with access to the `file` tool (post-fix for GHSA-cvhv-7xhj-xjp8, i.e. a properly\nauthenticated Administrator-level caller) can read `data/.siyuan/publishAccess.json` directly:\n\n```go\ntype PublishAccessItem struct {\n    ID       string `json:\"id\"`\n    Visible  bool   `json:\"visible\"`\n    Password string `json:\"password\"` // plaintext; empty string = no password\n    Disable  bool   `json:\"disable\"`\n}\n```\n\nThis exposes the plaintext access password for every publish-mode-shared notebook/document,\nletting the reader bypass password protection on any publish-mode share. This is a serious\nsibling issue given the volume of publish-mode access-control bugs already reported against this\ncodebase — the passwords protecting exactly that feature are directly readable through a tool\nwhose own description says \"never use for workspace data.\"\n\n`data/templates` and `data/snippets/conf.json` are lower-severity but still inconsistent with\nthe HTTP API's own precedent for what counts as sensitive.\n\n## Why this is a distinct finding, not a duplicate\n\nGHSA-cvhv-7xhj-xjp8 was about *reachability* an unauthenticated Reader-tier JWT being forwarded\nto admin-scoped paths including `/mcp`. That has been fixed. This report is about the *tool's own\nscope* once reached by a legitimate, properly-authenticated caller, the remediation notes for\nthat same advisory explicitly called for restricting `resolvePath` to\n`WorkspaceDir/temp/siyuan/*.log`, which was not implemented; instead the tool retains\nworkspace-wide scope with only a single-file blocklist addition.\n\n## Suggested fix\n\nEither replicate the full `refuseToAccess()` blocklist in `resolvePath()` (minimum fix, keeps\nparity with the HTTP API going forward by extracting `refuseToAccess`'s path list into a shared\nhelper both call), or implement the originally-recommended allowlist restricting the tool to\n`WorkspaceDir/temp/siyuan/*.log` for read and disabling write/delete/rename/copy entirely unless\nthe caller is Administrator, matching the tool's own advertised \"debugging/log reading only\"\nscope.","categories":["Libraries & packages"],"product":"github.com/siyuan-note/siyuan/kernel","vendor":"siyuan-note","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-c8r8-95hg-mp34","source_modified_at":"2026-10-27T14:43:58Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"go","name":"github.com/siyuan-note/siyuan/kernel"},"range":"< 0.0.0-20260808051406-3542530c505f"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-60083","source_modified_at":"2026-08-24T18:41:00.990Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"siyuan","vendor":"siyuan-note","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"3.8.0"},{"version":"3.8.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c8r8-95hg-mp34","source_modified_at":"2026-10-27T15:00:04.502338776Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"github.com/siyuan-note/siyuan/kernel","ecosystem":"Go","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260808051406-3542530c505f"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-c8r8-95hg-mp34","source_modified_at":"2026-10-27T14:43:58Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"go","name":"github.com/siyuan-note/siyuan/kernel"},"version":"0.0.0-20260808051406-3542530c505f"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-60083","source_modified_at":"2026-08-24T18:41:00.990Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"siyuan","ecosystem":null},"version":"3.8.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c8r8-95hg-mp34","source_modified_at":"2026-10-27T15:00:04.502338776Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"github.com/siyuan-note/siyuan/kernel","ecosystem":"Go","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel"},"version":"0.0.0-20260808051406-3542530c505f"}],"cvss":4.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00391,"percentile":0.33097,"score_date":"2026-10-27"},"published_at":"2026-08-22T12:26:36.709Z","modified_at":"2026-10-27T15:00:04.502338776Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-c8r8-95hg-mp34","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T14:43:58Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-60083","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-08-24T18:41:00.990Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-c8r8-95hg-mp34","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T15:00:04.502338776Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-60083","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60083","source":"GitHub Advisory Database"},{"url":"https://github.com/siyuan-note/siyuan/commit/3542530c505f13aa3fbd0343627409ca6c000dd2","source":"GitHub Advisory Database"},{"url":"https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-c8r8-95hg-mp34","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-08-24T18:40:48.540853Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T15:00:04.502338776Z","content_hash":"fb616e0d9a2343f8ae9fe165a08fe95857a0d70a45087315b8c0bbf6055f9849"}}