What is the CVSS score of CVE-2026-59854?

CVE-2026-59854 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

SiYuan CVE-2026-59854

MEDIUM

Protection Mechanism Failure (CWE-693)

2026-07-09 GitHub_M

Information Disclosure Docker Siyuan Siyuan Note

4.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Network-accessible API (AV:N) requires admin or API-token authentication (PR:H); credential file exfiltration is C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 23:31 vuln.today

DescriptionCVE.org

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts attacker-supplied absolute source paths and relies on util.IsSensitivePath in kernel/util/path.go, whose denylist misses common home-directory credential files such as .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg, allowing an authenticated administrator or API-token user to copy those files into the workspace and exfiltrate them through the file API. This issue is fixed in versions 3.7.1-alpha.2 and 3.7.1.

AnalysisAI

Credential file exfiltration in SiYuan prior to 3.7.1 is possible through the POST /api/file/globalCopyFiles endpoint, which accepts arbitrary absolute source paths and relies on an incomplete denylist in util.IsSensitivePath to block sensitive files. The denylist omits common credential files including .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg, enabling an authenticated administrator or API-token holder to copy these files into the workspace and read them via the file API. No public exploit code or CISA KEV listing exists at time of analysis, but the Docker tag suggests this is relevant in containerized deployments where host-mounted credential files may be accessible.

Technical ContextAI

SiYuan (CPE: cpe:2.3:a:siyuan-note:siyuan:*:*:*:*:*:*:*:*) is an open-source personal knowledge management system with a local-first architecture backed by a Go kernel. The affected endpoint POST /api/file/globalCopyFiles is a server-side API that processes user-supplied file paths. The protection mechanism in kernel/util/path.go uses a denylist approach (util.IsSensitivePath) to block access to sensitive filesystem paths - a classic CWE-693 (Protection Mechanism Failure) anti-pattern, where reliance on incomplete enumeration rather than allowlisting leads to coverage gaps. The denylist fails to enumerate widely-used home-directory credential stores such as .kube/config (Kubernetes credentials), .docker/config.json (Docker registry tokens), .netrc (FTP/HTTP credentials), .pgpass (PostgreSQL credentials), .git-credentials, and .gnupg (GPG keyrings). Once a file is copied into the workspace, SiYuan's own file-serving API can be used to retrieve its contents, completing a two-step exfiltration path entirely within the application.

RemediationAI

Upgrade SiYuan to version 3.7.1 (stable) or 3.7.1-alpha.2 (pre-release), both of which contain the fix as confirmed by commits 914c5180a88d17f6d38716a56483327b367ef55f and b54fee401799d987d2fd2888220938ad599b8c5e. The fix is available at https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1. For deployments that cannot immediately upgrade, restrict access to the SiYuan API port to trusted network segments only, as this eliminates the network-accessible attack surface. Do not rely on the existing denylist as a compensating control - the core defect is the denylist's incomplete enumeration, and it cannot be safely extended in-place without patching. In Docker environments, avoid mounting the host home directory or credential directories (e.g., ~/.kube, ~/.docker) into the SiYuan container; instead, use dedicated service accounts with scoped credentials. Revoke and rotate any credentials stored in the affected file types (.kube/config, .docker/config.json, .netrc, .pgpass, .git-credentials, .gnupg) if there is reason to believe the system was accessed by unauthorized API-token holders prior to patching.