CVE-2026-116168
MEDIUM
NVD
CVSS Score
6.2
Severity
MEDIUM
Published
Oct 25, 2026
Vendor
unknown
Description
SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits .env and other secret files. Authenticated attackers driving the MCP asset upload action can copy such local files into the workspace and read them back via /assets/ over HTTP.