Medium
github
·
GHSA-p23f-cm6q-2qp8
SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)
Published Oct 2, 2026
CVSS 5.7
Security Advisory — SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)
| Field | Value |
|---|---|
| Disclosed by | joysinleung ([email protected]) |
| Report date | 2026-08-13 |
| Product | SiYuan (思源笔记) — siyuan-note/siyuan |
| Go module | github.com/siyuan-note/siyuan/kernel |
| Affected versions | ` Note: patch authored against v3.8.0 source; not compiled into a full SiYuan release build. Provided for the maintainer to validate in CI. |
Appendix: Suggested Patch (F10)
diff --git a/kernel/mcp/tools/asset.go b/kernel/mcp/tools/asset.go
index aaa..bbb 100644
--- a/kernel/mcp/tools/asset.go
+++ b/kernel/mcp/tools/asset.go
@@ -195,8 +195,16 @@ func assetUpload(args map[string]any) (CallToolResult, error) {
fileList := strings.Split(filesStr, ",")
for i, f := range fileList {
abs, err := filepath.Abs(strings.TrimSpace(f))
- if err != nil {
+ if err != nil {
return CallToolResult{}, err
}
+ // 边界校验：仅允许工作区内的资产，拒绝任意绝对路径越界读
+ if !util.IsSubPath(util.WorkspaceDir, abs) || util.IsSensitivePath(abs) {
+ ret.Code = -1
+ ret.Msg = fmt.Sprintf("asset path %s is outside the workspace or sensitive", abs)
+ return CallToolResult{}, fmt.Errorf("asset path outside workspace: %s", abs)
+ }
fileList[i] = abs
}
succMap, err := model.InsertLocalAssets(id, fileList, true)
Affected AI Products
prompt injection
ai agent