CVE record published for path traversal in SiYuan's database_clean MCP tool, a hardening gap the HTTP API had already closed

VulnCheck published CVE-2026-74798 on 2026-08-17, covering a path traversal in the MCP tool surface of SiYuan, a self-hosted note-taking application. The database_clean tool checked only that its id parameter was not an empty string, then passed it to RemoveUnusedAttributeView in kernel/model/attribute_view.go, which builds a filesystem path with filepath.Join without checking that id matches SiYuan's node-ID format.

The consequence is two operations for the price of one traversal string. The routine copies the target file into SiYuan's history directory, which an authenticated MCP client can then read, and deletes the original. VulnCheck scores it 9.3 critical under CVSS 4.0 and 8.7 high under CVSS 3.1.

SiYuan's own advisory is direct about the shape of the gap. GHSA-43jx-gxq4-jpjc, published 2026-08-03, titles the issue as one "missed by the recent GHSA-7hm9-v7vf-7g4w fix", and the CVE record says the same: "The corresponding HTTP API handler was hardened in GHSA-7hm9-v7vf-7g4w, but this MCP caller was not." The same function had two callers, and only one of them was fixed.

Versions are the one place the record and the repository disagree. Both the CVE and the advisory name 3.7.4 as the patched version, and SiYuan never published a stable 3.7.4: its releases run v3.7.3 on 2026-07-21, then a 3.7.4 alpha line ending at v3.7.4-alpha.6 on 2026-08-02, then v3.8.0 on 2026-08-12. The guard is present in v3.8.0, where RemoveUnusedAttributeView returns early unless ast.IsNodeIDPattern matches the supplied id, with a comment stating the check is there to block traversal reads and deletions. Neither record identifies which published release users should move to.