SiYuan: Path traversal in MCP web_fetch allows arbitrary file write
Summary
SiYuan on Windows contains a path traversal flaw in its web fetch code, which backs the MCP web_fetch and http_request tools. An attacker who controls a URL fetched by these tools can use percent-encoded dot-dot-backslash sequences in the filename to write chosen response bytes to directories above the import folder. The write succeeds only where the SiYuan user has write permission, and the CVSS vector scores integrity impact only and requires user interaction.
Affected
- SiYuan 3.7.0 up to but not including 3.8.10, Windows only.
- VulDB also lists 3.8.9 as affected; this conflicts with the vendor's fix version and is unverified.
Fixed in
- Upgrade to SiYuan 3.8.10 or later.
Workaround
- Unknown. No vendor workaround is documented.
- Interim measure (own recommendation): disable the AI agent or MCP web-fetch features where they are not needed.
Exploitation
- VulDB states that no exploit exists.
- No public proof of concept or in-the-wild exploitation found. CISA KEV status not checked.
Our recommendation
- Upgrade Windows installations of SiYuan to 3.8.10 in the next regular update cycle.
- Prioritise systems where the AI agent or MCP web-fetch tools are enabled.
- Disable these tools where they are not required.
- Review the import directory and the SiYuan user's write permissions for unexpected files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vulnerable code: webfetch.go at v3.7.0 github.com
- Fix commit 94d6a42 github.com
- SiYuan v3.8.10 release github.com
- SiYuan security advisory GHSA-hq2c-hh95-vrr6 github.com
- VulnCheck advisory: path traversal via MCP web_fetch www.vulncheck.com
- VulDB entry 435962 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:42.
Original description (NVD)
SiYuan 3.7.0 before 3.8.10 on Windows contains a path traversal vulnerability in kernel/util/webfetch.go that allows attackers to write files outside the import directory via backslash-encoded filenames. Attackers controlling a URL fetched by the MCP web_fetch or http_request tools can use %5C-encoded ..\ sequences to write chosen response bytes to directories above temp/import that are writable by the SiYuan user.
NVD references (5)
- https://github.com/siyuan-note/siyuan/blob/v3.7.0/kernel/util/webfetch.go#L155
- https://github.com/siyuan-note/siyuan/commit/94d6a42a0362c0a6938a29ab84addb1fe0aca21c
- https://github.com/siyuan-note/siyuan/releases/tag/v3.8.10
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hq2c-hh95-vrr6
- https://www.vulncheck.com/advisories/siyuan-3.7.0-before-3.8.10-path-traversal-file-write-via-mcp-web-fetch
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.