Which versions of SiYuan are affected by CVE-2026-65607?

SiYuan, a personal knowledge-management application used by teams to organize internal documentation, contains an authenticated file-read vulnerability affecting versions before v3.7.2 that exposes…. A patch is available.

How to fix or mitigate CVE-2026-65607?

Within 24 hours, identify and catalog all SiYuan deployments in your environment and their current version numbers, then restrict user access to non-upgraded instances. Within 7 days, upgrade all SiYuan instances to v3.7.2 or later and validate the upgrade by confirming the /export/temp/ endpoint no longer processes percent-encoded path traversal sequences as documented in the advisory. Within 30 days, audit file access logs for suspicious export requests, regenerate all SSH keys or credentials accessible to SiYuan processes, review and tighten file-system permissions to minimize the application's read access scope, and implement network-level controls limiting export endpoint access.

SiYuan CVE-2026-65607

Q: What is the CVSS score of CVE-2026-65607?

CVE-2026-65607 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-48243 HIGH

Path Traversal (CWE-22)

2026-07-23 disclosure@vulncheck.com

GHSA-2vq9-c755-fq2h

Path Traversal

7.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint requiring a low-privileged authenticated session (PR:L), no user interaction, low complexity, and read-only arbitrary file disclosure so C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 14:04 EUVD

Source Code Evidence Fetched

Jul 23, 2026 - 12:51 vuln.today

Analysis Generated

Jul 23, 2026 - 12:51 vuln.today

CVE Published

Jul 23, 2026 - 12:18 cve.org

HIGH 7.1

DescriptionCVE.org

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.

AnalysisAI

Arbitrary file read in SiYuan (an open-source personal knowledge-management / note-taking application) before v3.7.2 allows an authenticated attacker to retrieve files anywhere on the host by abusing the /export/temp/ short-circuit branch of the serveExport handler. Because this branch joins the raw, percent-decoded request path to the temp directory without the IsSubPath or IsSensitivePath guards used elsewhere, percent-encoded '..' sequences escape TempDir and expose /etc/passwd, SSH private keys, and SiYuan's own workspace *.db and *.log files. No public exploit identified at time of analysis, though the advisory documents a concrete payload; EPSS and CISA KEV data are not provided in the input.

Technical ContextAI

SiYuan is a Go-based, self-hosted knowledge-base/notebook application whose kernel HTTP server (kernel/server/serve.go) exposes an /export/ route for downloading generated export artifacts. This is a classic CWE-22 path traversal: the vulnerable /export/temp/ short-circuit branch calls util.TempDir joined with the raw, already-percent-decoded request path and serves it directly. Unlike the main export branch - which was hardened in the earlier export-disclosure fix (GHSA-6865-qjcf-286f) - this branch omitted both gulu.File.IsSubPath (which confines the resolved path under the export base directory) and IsSensitivePath (which blocks sensitive files). The patch (commit bb481e1290c4) adds the missing IsSubPath check returning 401 on escape, and simultaneously extends IsSensitivePath in kernel/util/path.go to treat any *.db or *.log path as sensitive, closing both the traversal and the workspace-file disclosure.

RemediationAI

Upgrade to SiYuan v3.7.2 or later, which is the vendor-released patch (commit bb481e1290c4) that adds the missing IsSubPath confinement to the /export/temp/ branch and extends IsSensitivePath to cover *.db and *.log files; consult GHSA-gw25-m53r-qh88 for details. If immediate upgrade is not possible, restrict network reachability of the SiYuan kernel by binding it to localhost only and placing it behind an authenticating reverse proxy or firewall so untrusted clients cannot reach /export/temp/ (trade-off: breaks legitimate remote/multi-device access). Ensure a strong kernel access-authorization code is set to raise the bar for the required authenticated session, and, where the deployment permits, block or filter requests to the /export/temp/ path at the proxy (trade-off: may interrupt normal export downloads). Running the kernel under a low-privilege OS account limits which files a successful traversal can read but does not close the vulnerability.