Medium
6.0
SiYuan 3.7.0 before 3.8.10 Path Traversal File Write via MCP web_fetch
CVE-2026-126776
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| siyuan-notesiyuan |
≥ 3.7.0, < 3.8.10→ 3.8.10 |
3.8.10 |
Original description The description as published by the source.
SiYuan 3.7.0 before 3.8.10 on Windows contains a path traversal vulnerability in kernel/util/webfetch.go that allows attackers to write files outside the import directory via backslash-encoded filenames. Attackers controlling a URL fetched by the MCP web_fetch or http_request tools can use %5C-encoded ..\ sequences to write chosen response bytes to directories above temp/import that are writable by the SiYuan user.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory github.com
- advisory vulncheck.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com
- web github.com