CVE-2026-82233 siyuan-note CVE debrief

Who should care

Defenders responsible for SiYuan deployments, especially those with the Agent/MCP surface configured, should assess exposure and prioritize verification and remediation efforts. This includes verifying SiYuan version and exposure in specific deployment contexts, monitoring for anomalous file access patterns, and potential data exposure through arbitrary file reads. Defenders should also review compensating controls for exposed systems while remediation is

Why it matters

Defenders should prioritize verifying and upgrading to version 3.8.1 if using SiYuan versions <= 3.8.0, and assess exposure in their specific deployment contexts, especially where the Agent/MCP surface is configured and user approval clicks are required.

• Verification of SiYuan version and exposure in specific deployment contexts
• Monitoring for anomalous file access patterns
• Potential data exposure through arbitrary file reads

Technical summary

The SiYuan MCP `asset.upload` function reads arbitrary absolute file paths, bypassing workspace boundaries. This vulnerability is residual from CVE-2026-66012 and affects SiYuan versions <= 3.8.0. The patched version is 3.8.1. The vulnerability requires AI Agent invocation of `asset.upload` and user approval, with a low EPSS exploitation probability. The boundary check is absent, allowing arbitrary absolute file paths to be read. Defenders should prioritize verifying and upgrading to version 3.8.1 if using SiYuan versions <= 3.8.0, and assess exposure in their specific deployment contexts.

Defensive priority

Defenders should prioritize verifying and upgrading to version 3.8.1 if using SiYuan versions <= 3.8.0, and assess exposure in their specific deployment contexts, especially where the Agent/MCP surface is configured and user approval clicks are required.

Recommended defensive actions

• Verify and upgrade to SiYuan version 3.8.1 if using versions <= 3.8.0
• Assess exposure in specific deployment contexts where Agent/MCP surface is configured
• Monitor for user approval clicks and potential anomalous file access patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The advisory indicates that the vulnerability is in the `kernel/mcp/tools/asset.go` (`assetUpload`) and `kernel/model/upload.go` (`InsertLocalAssets`) components. The EPSS exploitation probability is low, requiring AI Agent invocation of `asset.upload` and user approval. The boundary check is absent, allowing arbitrary absolute file paths to be read.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.