Threats Tagged 'ghsa-x2gq-fcjj-cxqr'

SiYuan versions 3.8.0 through 3.8.3 contain an authorization bypass vulnerability in the MCP file tool's sensitive-path guard. The guard is applied only to the root of recursive operations but not to each descendant path, allowing an authenticated administrator to bypass protections on sensitive files and directories. This enables actions such as reading, copying, and overwriting protected files without proper confirmation. The issue is fixed in version 3.8.4.