What happened
SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files that are otherwise protected by the HTTP API, allowing authenticated administrators (and potentially MCP clients with equivalent access) to read plaintext publish-mode passwords and other protected files.
Why it matters
Demonstrates that MCP tool authorization boundaries frequently do not mirror an application's own HTTP API access controls, creating a bypass path where the MCP surface is less restrictive than the primary application interface it wraps.
Attack vector
An MCP client with file-tool access uses paths that evade the incomplete path blocklist to read files that should be restricted by the HTTP API, including data/.siyuan/publishAccess.json which stores plaintext publish-mode passwords.
Affected systems
SiYuan before v3.8.0 (MCP file tool)
Mitigation
Upgrade to SiYuan v3.8.0 or later; audit MCP file-tool path restrictions; rotate any publish-mode passwords that may have been exposed.