CVE-2026-85580

SiYuan, an open-source note-taking and knowledge-management application, versions before v3.8.2 contain a path guard bypass (CWE-22) in the MCP (Model Context Protocol) file-access handler: the guard compares requested paths case-sensitively on Linux filesystems, so a case-variant request such as 'PublishAccess.json' slips past the intended restriction. An attacker with low-privileged (authenticated) network access to an affected instance's MCP file-access interface can trigger the bypass by requesting case-variant paths. Successful exploitation discloses the protected publishAccess.json file, leaking the instance's publish-access configuration and metadata; the impact is confidentiality-only (no file modification or execution). Any SiYuan instance running a version before 3.8.2 is affected, with practical exposure limited to Linux deployments where the MCP file-access handler and publish feature are enabled and network-reachable. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS currently estimates only about a 0.5% probability of exploitation within 30 days, so no in-the-wild exploitation is known.

What to do: Upgrade SiYuan to v3.8.2 or later, which fixes the MCP path guard. As interim mitigation on pre-3.8.2 versions, restrict the MCP file-access interface to trusted or local networks (e.g., firewall or bind to localhost) and verify on Linux instances that case-variant requests such as 'PublishAccess.json' no longer return the protected publishAccess.json file.