CVE-2026-85580: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in siyuan-note siyuan

CVE-2026-85580 describes a path traversal vulnerability in SiYuan note-taking software prior to version 3.8.2. The vulnerability arises because the MCP file-access handler performs case-sensitive matching on Linux filesystems, which can be bypassed by requesting differently cased variants of protected file paths. This allows unauthorized reading of the publishAccess.json file, which contains sensitive publish-access configuration and metadata. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity. No official remediation level or patch information is provided in the available data.

An attacker with low privileges and no user interaction can exploit this vulnerability remotely over the network to read sensitive configuration files that should be protected. Disclosure of the publishAccess.json file could lead to exposure of sensitive metadata related to publish access controls, potentially aiding further attacks or information leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restricting access to the affected software on Linux systems or applying filesystem-level protections may help mitigate risk.