PT-2026-63973 · Siyuan · Siyuan
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.7.2
Description
An authenticated attacker can exploit a path traversal issue in the
/export/temp/ endpoint within the serveExport handler (located in kernel/server/serve.go). The vulnerability exists because the short-circuit branch of this handler joins the percent-decoded request path with util.TempDir without performing IsSubPath or IsSensitivePath security checks. By using percent-encoded traversal sequences, such as %2e%2e (which decodes to ..), an attacker can bypass sensitive-file protections to read arbitrary files outside the intended directory, including system files like /etc/passwd, SSH keys, and workspace .db and .log files.Recommendations
Update SiYuan to version 3.7.2 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Siyuan