What is GHSA-rp7c-4prv-9rrg?

GHSA-rp7c-4prv-9rrg is a security advisory published by GitHub Security Advisories with Medium severity. SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that...

Which CVE IDs does GHSA-rp7c-4prv-9rrg cover?

GHSA-rp7c-4prv-9rrg covers the following CVE IDs: CVE-2026-60083. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rp7c-4prv-9rrg?

GHSA-rp7c-4prv-9rrg has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

GHSA-rp7c-4prv-9rrgMediumCVSS 4.9

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that...

Vendor

GitHub Security Advisories

Published

August 22, 2026

Last Modified

August 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-60083 →

📋 Description

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access other sensitive files like data/templates and data/snippets/conf.json.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c8r8-95hg-mp34
https://nvd.nist.gov/vuln/detail/CVE-2026-60083
https://www.vulncheck.com/advisories/siyuan-before-incomplete-path-blocklist-via-mcp-file-tool
https://github.com/advisories/GHSA-rp7c-4prv-9rrg