https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:49:50.386356+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-82233 CVE-2026-82233 — SiYuan before v3.8.1 Path Traversal via asset.upload 2026-10-08T14:49:50.403263+00:00

Affected: siyuan-note siyuan

SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.