CVE-2026-74798

Name of the Vulnerable Software and Affected Versions SiYuan kernel versions prior to 3.7.4

Description A path traversal issue exists in the database clean MCP tool. The tool only performs an empty-string check on the id parameter before passing it to the RemoveUnusedAttributeView() function, which constructs a filesystem path using filepath.Join without verifying that the id follows the required node-ID format. An authenticated MCP client can use path traversal sequences in the id parameter to force the kernel to copy any file readable by the process into the history directory and subsequently delete the original file.

Recommendations Update to version 3.7.4 or later. As a temporary mitigation, restrict access to the database clean MCP tool or avoid using the id parameter until the update is applied.