What is GHSA-m4pm-qxhv-84p5?

GHSA-m4pm-qxhv-84p5 is a security advisory published by GitHub Security Advisories with Medium severity. SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that...

Which CVE IDs does GHSA-m4pm-qxhv-84p5 cover?

GHSA-m4pm-qxhv-84p5 covers the following CVE IDs: CVE-2026-82233. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m4pm-qxhv-84p5?

GHSA-m4pm-qxhv-84p5 has a CVSS v3 base score of 5.7, published by GitHub Security Advisories.

GHSA-m4pm-qxhv-84p5MediumCVSS 5.7

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that...

Vendor

GitHub Security Advisories

Published

August 28, 2026

Last Modified

August 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-82233 →

📋 Description

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p23f-cm6q-2qp8
https://nvd.nist.gov/vuln/detail/CVE-2026-82233
https://www.vulncheck.com/advisories/siyuan-before-3.8.1-path-traversal-via-asset-upload
https://github.com/advisories/GHSA-m4pm-qxhv-84p5