Path Traversal Vulnerability in SiYuan Asset Tool

CVE-2026-116168

What is CVE-2026-116168?

SiYuan prior to version 3.8.7 exhibits a path traversal vulnerability within the MCP asset tool, stemming from a deficient sensitive-path blacklist. This vulnerability allows authenticated attackers to exploit the asset upload functionality, enabling them to access and read sensitive files such as .env files stored locally. By leveraging this flaw, attackers can manipulate the asset upload process and retrieve protected information through HTTP requests, posing serious security risks to affected instances.

References