What happened
SiYuan's validateAssetUploadPaths relies on an incomplete sensitive-path blacklist (an incomplete fix of GHSA-p23f-cm6q-2qp8) that omits .env and other secret-bearing files. An attacker driving the agent-facing MCP asset upload action can copy a local file such as the host user's ~/.env into the workspace's data/assets directory; the server then serves that file back over HTTP (GET /assets/<name>), turning the MCP tool into a local-file-read oracle.
Why it matters
The chain is entirely agentically reachable with no filesystem access required: an attacker who can steer an agent talking to SiYuan's MCP server can read home-directory secrets (.env, .env.local, ~/Library/** Keychain, Windows AppData) from the host and exfiltrate them through the workspace HTTP route (CWE-22/CWE-200, CVSS 6.2).
Attack vector
Drive the MCP asset upload action with an absolute path such as /home/<user>/.env; the server copies it into the workspace and serves it back over authenticated HTTP.
Affected systems
SiYuan before 3.8.7 (MCP asset upload tool).
Mitigation
Upgrade to SiYuan 3.8.7; the proper fix is to reject at read time and only accept paths under an operator-granted workspace root rather than extending the name blacklist.