External risk intelligence

SiYuan Kernel Path Traversal Arbitrary File Read and Deletion via Database Clean Tool

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-74798

The vulnerability exists in an MCP (Model Context Protocol) tool within the SiYuan kernel, which is typically used for local application integration rather than public-facing services. While network-reachable in some configurations, it is not a standard internet-facing edge service or public API endpoint.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the SiYuan kernel's database cleaning tool could allow an authenticated user to read and delete arbitrary files on the system. This issue arises from insufficient validation of a parameter used to identify database entries, enabling attackers to manipulate file paths.

Allows file reading and deletion via a tool.
Affects authenticated users with specific tool access.
Confirm relevance and exposure to SiYuan instances.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to the SiYuan kernel's MCP tool can exploit a path traversal flaw to read and delete arbitrary files. The vulnerability arises because the tool does not properly validate the `id` parameter, allowing an attacker to craft special input that manipulates file paths. This can result in the kernel copying a file readable by the process to the history directory and then deleting the original file.

Authenticated MCP client needed.
Path traversal via `id` parameter.
Arbitrary file read and deletion.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user with access to the database_clean MCP tool could leverage a path traversal vulnerability to read and delete arbitrary files on the system. This could occur when the tool processes an improperly validated `id` parameter, allowing it to construct file paths outside of its intended directory when supported by the advisory.

System files could be read.
Malicious input in `id` parameter.
Arbitrary file read and deletion.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SiYuan kernel's MCP tool is likely managed by the application or platform team responsible for its integration and maintenance. The first practical step is to identify all instances of the SiYuan kernel, confirm if the MCP tool is exposed externally or to untrusted inputs, and then determine the business criticality of affected instances to prioritize remediation efforts.

Application or platform team ownership.
Verify MCP tool exposure and reachability.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SiYuan kernel?

SiYuan is a privacy-first, self-hosted personal knowledge management system. Its kernel manages core backend functions, including database operations and file storage. Many users run it as a local or private server to organize notes, documents, and data, relying on these internal processes to maintain the integrity of their information.

How does CVE-2026-74798 allow file manipulation?

This vulnerability is a Path Traversal, classified as CWE-22. It occurs when software uses input to build a file path without sufficient validation. In this case, the 'database_clean' tool fails to check if an identifier matches expected formats. This allows an attacker to 'traverse' outside authorized directories, tricking the kernel into accessing, copying, or deleting files elsewhere on the system that the SiYuan process has permission to reach.

Does any input trigger this flaw?

No. The vulnerability requires a specific sequence in the 'id' parameter to navigate file paths. Simply using the tool normally or providing an empty string will not trigger the bug, as the code performs a basic check for empty inputs. Exploitation only occurs when an attacker specifically crafts malicious directory traversal characters within the 'id' field to manipulate how the kernel constructs file system paths.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal currently labels this as 'Unlikely' to be internet-facing. Because this issue resides in an MCP (Model Context Protocol) tool—typically used for local application integrations—it is generally not exposed as a standard public-facing web endpoint. However, if your specific configuration bridges this internal tool to untrusted network segments, the risk level for your environment increases.

What should I do if I run SiYuan?

First, audit your environment to locate all SiYuan kernel instances. Confirm whether your setup allows access to the MCP tools from outside your trusted network. If you find these tools are accessible to untrusted users or systems, restrict that access immediately. Prioritize these updates or configuration changes based on the sensitivity of the data stored within your SiYuan database and the criticality of the system hosting it.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.