CVE-2026-74798: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in siyuan-note siyuan
SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView (kernel/model/attribute_view.go), which builds a filesystem path via filepath.Join without validating that id matches SiYuan's node-ID format. An authenticated MCP client can supply path traversal sequences in id to cause the kernel to copy an arbitrary file readable by the process into SiYuan's history directory (arbitrary file read) and then delete the original file (arbitrary file deletion). The corresponding HTTP API handler was hardened in GHSA-7hm9-v7vf-7g4w, but this MCP caller was not.
AI Analysis
Technical Summary
CVE-2026-74798 is a path traversal vulnerability in the SiYuan kernel's database_clean MCP tool prior to version 3.7.4. The tool insufficiently validates the id parameter, only checking for empty strings before passing it to RemoveUnusedAttributeView, which constructs filesystem paths without verifying that id conforms to the expected node-ID format. An authenticated MCP client can exploit this by injecting path traversal sequences, causing the kernel to copy arbitrary readable files into SiYuan's history directory and subsequently delete the original files. The HTTP API handler was fixed in GHSA-7hm9-v7vf-7g4w, but the MCP interface remains vulnerable. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity.
Potential Impact
An authenticated MCP client can exploit this vulnerability to read arbitrary files accessible by the SiYuan process and delete arbitrary files on the filesystem. This can lead to unauthorized data disclosure and data loss within the affected system. The vulnerability affects the integrity and confidentiality of the system's data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The HTTP API handler was hardened, but the MCP caller remains vulnerable. Until an official fix is released, restrict MCP client access to trusted users only and monitor for suspicious activity related to file operations.
CVE-2026-74798: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in siyuan-note siyuan
Description
SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView (kernel/model/attribute_view.go), which builds a filesystem path via filepath.Join without validating that id matches SiYuan's node-ID format. An authenticated MCP client can supply path traversal sequences in id to cause the kernel to copy an arbitrary file readable by the process into SiYuan's history directory (arbitrary file read) and then delete the original file (arbitrary file deletion). The corresponding HTTP API handler was hardened in GHSA-7hm9-v7vf-7g4w, but this MCP caller was not.
CVSS v4.0
Score 9.3critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-74798 is a path traversal vulnerability in the SiYuan kernel's database_clean MCP tool prior to version 3.7.4. The tool insufficiently validates the id parameter, only checking for empty strings before passing it to RemoveUnusedAttributeView, which constructs filesystem paths without verifying that id conforms to the expected node-ID format. An authenticated MCP client can exploit this by injecting path traversal sequences, causing the kernel to copy arbitrary readable files into SiYuan's history directory and subsequently delete the original files. The HTTP API handler was fixed in GHSA-7hm9-v7vf-7g4w, but the MCP interface remains vulnerable. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity.
Potential Impact
An authenticated MCP client can exploit this vulnerability to read arbitrary files accessible by the SiYuan process and delete arbitrary files on the filesystem. This can lead to unauthorized data disclosure and data loss within the affected system. The vulnerability affects the integrity and confidentiality of the system's data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The HTTP API handler was hardened, but the MCP caller remains vulnerable. Until an official fix is released, restrict MCP client access to trusted users only and monitor for suspicious activity related to file operations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-16T12:59:42.223Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a82f001bf8831d539c482c1
Added to database: 08/17/2026, 11:26:57 UTC
Last enriched: 08/17/2026, 11:57:05 UTC
Last updated: 08/18/2026, 00:25:23 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.