SiYuan MCP asset.upload Path Traversal via Prompt Injection

Technical Analysis

The asset.upload MCP tool accepts arbitrary absolute file paths as a parameter without enforcing workspace boundary checks, meaning any path on the host filesystem the agent process can read is a valid input. An attacker delivers a prompt injection payload (e.g., embedded in a document, webpage, or other content the agent ingests) instructing the agent to invoke asset.upload with a path pointing to a sensitive file such as ~/.ssh/id_rsa or a credentials file. Because the LLM-driven agent has no independent judgment about path legitimacy and the tool itself performs no server-side validation, the file is copied into the asset directory, which is typically web-accessible or exportable, giving the attacker a path to retrieve the exfiltrated secret. This crosses the boundary between untrusted content (the injection source) and a privileged filesystem-access tool, converting an indirect prompt injection into direct local file disclosure.

Affected Systems

SiYuan; protocols: MCP

Detection Signatures

• Tool invocation logs showing asset.upload called with absolute paths outside the workspace root (e.g., paths containing /.ssh/, /etc/, C:\Users\*\.ssh\)
• MCP requests where the source_path parameter resolves outside a whitelisted workspace directory via path normalization
• Unusual agent tool-call sequences immediately following ingestion of untrusted external content (web pages, documents, emails)
• Newly created files in the asset directory with names/extensions inconsistent with typical user uploads (e.g., id_rsa, .pem, .env, credentials.json)

Remediation Steps

1. 1

   Upgrade SiYuan

   Update to SiYuan v3.8.1 or later, which addresses the path traversal vulnerability in the asset.upload MCP tool.

2. 2

   Enforce workspace path canonicalization

   Ensure the tool resolves and canonicalizes all input paths, rejecting any that fall outside the configured workspace root before performing file operations.

3. 3

   Restrict MCP tool file access

   Run the MCP server/agent process under a restricted OS user with no read access to sensitive directories like SSH key stores or credential files.

4. 4

   Sanitize untrusted content before agent ingestion

   Apply prompt-injection filtering or content isolation to documents, web pages, and other external inputs processed by the agent prior to tool invocation.

5. 5

   Add human-in-the-loop confirmation

   Require explicit user approval for file upload/copy operations that reference paths outside expected directories.