CVE-2026-41894
published 2026-04-24CVE-2026-41894: SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did…
PriorityP343high7.1CVSS 4.0
AVNACLATNPRLUINVCHVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.31%
24.4th percentile
SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did not address the root cause — a redundant url.PathUnescape() call in serveExport(). An authenticated attacker can use double URL encoding (%252e%252e) to traverse directories and read arbitrary workspace files including the full SQLite database (siyuan.db), kernel log, and all user documents. This vulnerability is fixed in 3.6.5.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | siyuan-note_siyuan_kernel | >= 0 < 0.0.0-20260704035520-68cc0f537dfa | 0.0.0-20260704035520-68cc0f537dfa |
| github.com | siyuan-note_siyuan_kernel | >= 0 < 0.0.0-20260510110132-b763d787d1f2 | 0.0.0-20260510110132-b763d787d1f2 |
| github.com | siyuan-note_siyuan_kernel | >= 0 < 0.0.0-20260628153353-2d5d72223df4 | 0.0.0-20260628153353-2d5d72223df4 |
| siyuan-note | siyuan | < 3.7.0 | 3.7.0 |
CVSS provenance
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa9.8CRITICAL
vulncheck7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)
ghsa·2026-09-03·CVSS 9.8
CVE-2026-30869 [CRITICAL] CWE-22 SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)
SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)
## Summary
SiYuan's `/export/` file handler was hardened against export disclosure (issue #12213) by adding an
`IsSubPath(exportBaseDir, fullPath)` check and an `IsSensitivePath()` check in commit `bb481e1`. These guards
were added only to the main branch of the handler. The handler begins with a short-circuit branch:
```go
if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") {
c.File(filepath.Join(util.TempDir, c.Request.URL.Path))
return
}
```
This branch joins the **broader** `util.TempDir` with the raw, percent-decoded request path and serves it with
**neither** `IsSubPath` **nor** `IsSensitivePath`. An authenticated request to
`/export/temp/%2e%
GHSA
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
ghsa·2026-09-02·CVSS 9.8
CVE-2026-59832 [CRITICAL] CWE-22 Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
Reporter: Cavan Loughran, Celvex Group Inc.
Summary
The /snippets/*filepath route handler serveSnippets in kernel/server/serve.go performs a bare filepath.Join(util.SnippetsPath, filePath) on the single-decoded c.Request.URL.Path and serves the result with c.File(), with NO IsSubPath containment and NO IsSensitivePath denylist - unlike the sibling /export/ (serveExport) and /appearance/ (serveAppearance) handlers, which both carry IsSubPath, and unlike /assets/ (serveAssets), whose traversal was fixed in GHSA-p4m3-mgmm-c664. Because util.SnippetsPath = WorkspaceDir/data/snippets, an authenticated request to GET /snippets/%2e%2e/%2e%2e/conf/conf.json resolves to Wor
GHSA
SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894
ghsa·2026-07-10·CVSS 7.1
CVE-2026-54066 [HIGH] CWE-1188 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894
SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894
## Summary
The patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the `/export/` route but the
**identical root cause remains in the `/assets/*path` route**. In publish mode (anonymous read-only HTTP endpoint,
default port 6808), an unauthenticated remote attacker can read arbitrary files inside `WorkspaceDir` — including
`conf/conf.json` (which contains the `AccessAuthCode` SHA256 hash, API token, and sync keys), `temp/siyuan.db`,
`temp/blocktree.db`, and `siyuan.log` — by double-URL-encoding `..` segments.
Verified against siyuan v3.6.5:
- `GET /assets/%252e%252e/%252e%252e/conf/conf.json` → **HTTP 200, 10349 bytes (conf.json se
VulDB
SiYuan up to 3.6.4 url.PathUnescape path traversal
vuldb·2026-04-24·CVSS 7.1
CVE-2026-41894 [HIGH] SiYuan up to 3.6.4 url.PathUnescape path traversal
A vulnerability labeled as critical has been found in SiYuan up to 3.6.4. The affected element is the function url.PathUnescape. Executing a manipulation can lead to path traversal.
This vulnerability is registered as CVE-2026-41894. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
VulnCheck
b3log siyuan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2026·CVSS 7.1
CVE-2026-54066 [HIGH] b3log siyuan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
b3log siyuan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, default port 6808), an unauthenticated remote attacker can read arbitrary files inside WorkspaceDir — including conf/conf.json (which contains the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log — by double-URL-encoding .. segments. This vulnerability is fixed in 3.7.0.
Affected: b3log siyuan
Required Action: Apply remediations or mitigations per ve
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-24
Published