ETK-2026-1228Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1228",
  "cve_id": null,
  "display_id": "ETK-2026-1228",
  "ghsa_id": "GHSA-q768-4j87-gf3w",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "MCP asset upload path traversal in SiYuan",
  "summary": "SiYuan versions before 3.8.7 can let an authenticated MCP caller cause local files outside the workspace to be imported as workspace assets when path filtering misses them. An attacker able to invoke the MCP asset-upload tool with an authorized token can retrieve the imported file through the application's asset access path.",
  "mitigation": "Upgrade SiYuan to v3.8.7. Until upgraded, restrict MCP access and prevent the service account from reading sensitive files outside the workspace.",
  "vendor": "go",
  "product": "go:siyuan-note",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 3.8.6"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "v3.8.7"
      ],
      "package_name": "siyuan-note",
      "purl": "pkg:golang/siyuan-note"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 37.52455095,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-09T12:35:45+00:00",
      "days": -11.67756224199074,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:51:26.400299+00:00",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q768-4j87-gf3w"
    },
    "trigger_signal": {
      "at": "2026-10-09T12:35:45+00:00",
      "days": -11.67756224199074,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:51:26.400299+00:00",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q768-4j87-gf3w"
    }
  }
}