SiYuan MCP web_fetch/http_request tools path traversal lets a crafted URL write files outside the import directory

CVE-2026-126776 (CWE-22) is a path-traversal defect in SiYuan's kernel/util/webfetch.go on Windows, fixed in 3.8.10. The MCP web_fetch and http_request tools write fetched content to a path derived from the supplied URL; backslash-encoded (%5C) filenames escape the intended import directory, so an attacker controlling the fetched URL can write files to arbitrary writable locations for the app user.

This sits on the MCP tool surface of an agent/app that an LLM drives: because web_fetch/http_request are callable tools, a crafted URL (or a prompt-injection payload in fetched content) becomes an arbitrary file-write primitive on the host — a classic stepping stone to RCE or config tampering in an agentic deployment.

The web_fetch/http_request MCP tools do not properly restrict the resulting file path: backslash-encoded filenames (%5C) in an attacker-controlled fetched URL/response are resolved without traversal containment, allowing a file to be written outside the import directory on Windows. An attacker who controls the URL the agent fetches — directly or through prompt injection from fetched content — can place files at arbitrary writable locations for the app user.

SiYuan 3.7.0 before 3.8.10 (Windows) — kernel/util/webfetch.go web_fetch/http_request MCP tools.

Upgrade SiYuan to 3.8.10 or later. Review web_fetch/http_request handling for backslash normalization and enforce path containment within the import directory.