Joysinleung

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.1 **Description** A path traversal issue exists in the `asset.upload` MCP tool, which allows the use of arbitrary absolute file paths because it lacks workspace boundary validation. Through prompt injection, an attacker can trick the AI Agent into uploading sensitive files, such as SSH keys or credentials, from locations outside the workspace into the asset directory. **Recommendations** Update to version 3.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.1 **Description** Server-side request forgery (SSRF) exists in the `http request` and `web fetch` agent tools. The issue occurs because DNS resolution is performed only during the guard phase without validating the resolution at the time of connection. This allows attackers to use DNS rebinding—a technique where a DNS server changes the IP address associated with a domain name between the initial check and the actual connection—to bypass defenses. By providing a public IP during the guard resolution and a private or metadata IP during the connect resolution, an attacker can access internal services and cloud instance metadata. **Recommendations** Update to version 3.8.1.