PkgSeer

Vulnerability GO-2026-6655

Unknown

7 hours ago

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260813142104-b26a4a307b8a

Summary

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel

Details

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260816034002-035bf9a8c311 GO-2026-6662

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260819144130-256d73aa7f94 GO-2026-6663

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260813142806-dd2778b70d02 GO-2026-6657

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260721043339-eef10568384e GO-2026-6621

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block in github.com/siyuan-note/siyuan/kernel

<0.0.0-20260812083335-251596fc0de2 GO-2026-6635

View all vulnerabilities for these packages

Impacted packages

github.com/siyuan-note/siyuan/kernel

Timeline

Published

7 hours ago

Last Modified

3 hours ago