Path traversal in SiYuan /export/temp/ short-circuit branch (CVE-2026-65607)

SiYuan's serveExport handler contains a short-circuit branch for /export/temp/ requests that joins the raw percent-decoded request path with util.TempDir and serves files without the IsSubPath or IsSensitivePath checks present in the main branch. An authenticated attacker can supply percent-encoded traversal sequences (e.g. %2e%2e) to escape TempDir and read arbitrary files on the host, including /etc/passwd, SSH keys, and SiYuan workspace database and log files. This constitutes an incomplete fix for the prior export-disclosure hardening (GHSA-6865-qjcf-286f, CVE-2026-30869). Affected versions: - From commit bb481e1 (the hardening) through the latest master We recommend updating to: v3.7.2. CVSS 7.1 · our assessment: this_week Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gw25-m53r-qh88 Details: https://vuln.today/cve/CVE-2026-65607