CVE-2026-60083CWE-863broken-access-control

CVE-2026-60083

Medium · published August 22, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00391 · 32.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-22T17:16Z
References (2)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34 · [email protected]https://www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool · [email protected]
EPSS history
Timeline
  • 22 AUG 12:26Z
    SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool
    cvelistv5