The SiYuan MCP asset.upload tool accepts a comma-separated list of absolute file paths and normalizes them using filepath.Abs without enforcing workspace boundary or sensitive path checks. The InsertLocalAssets function then opens and copies these files into the workspace assets directory. Unlike other AI-plane file tools in SiYuan, asset.upload lacks any path restriction, allowing an attacker who can prompt-inject the AI Agent to cause it to upload arbitrary sensitive files. This is a residual issue following partial remediation of CVE-2026-66012, where asset.upload was not given the necessary boundary checks. The vulnerability was confirmed in version 3.8.0 and fixed in 3.8.1.

This vulnerability allows an attacker with the ability to influence the AI Agent and obtain user approval to read arbitrary local files on the victim's system by uploading them into the workspace. Sensitive files such as SSH private keys, AWS credentials, and system files can be exfiltrated through the workspace's note export or sync features. The impact is a confidentiality breach. There is no direct impact on integrity or availability. The exploitation probability is low due to the need for user approval and specific Agent/MCP configuration.

A patch is available in SiYuan version 3.8.1 that adds workspace boundary checks to the asset.upload tool, preventing arbitrary absolute path reads. Users should upgrade to version 3.8.1 or later to remediate this vulnerability. Until patched, administrators should be cautious about enabling the Agent/MCP interface and ensure users are aware of the risks of approving asset upload prompts, as the confirmation does not reveal the actual file paths being accessed.