SiYuan EUVD-2026-25626

Exploitation requires valid authentication credentials (PR:L per CVSS vector) to a SiYuan instance. The attacker must have at least low-privilege user access to reach the serveExport() endpoint. No special configuration, non-default settings, or specific features need to be enabled - the vulnerability exists in the default export functionality of all pre-3.6.5 installations. The network attack vector (AV:N) allows exploitation from any network location where the SiYuan web interface is accessible, including internet-exposed instances. Low attack complexity (AC:L) indicates no race conditions, timing dependencies, or environmental complexity. The primary limiting factor is the authentication requirement, making this an authenticated remote path traversal rather than unauthenticated access, which restricts exploitation to users with existing credentials or scenarios where attacker has compromised accounts.

Real-world risk is MODERATE despite the 7.1 CVSS score. The CVSS vector (AV:N/AC:L/PR:L) indicates network-exploitable with low complexity but requires authentication (PR:L), significantly limiting the attack surface compared to unauthenticated vulnerabilities. The impact is confined to confidentiality (VC:H/VI:N/VA:N) with no integrity or availability impact and no scope change (SC:N). Publicly available exploit code exists via the GitHub commit demonstrating the double-encoding technique, lowering the exploitation barrier for authenticated attackers. However, exploitation requires valid user credentials to the SiYuan instance, making this primarily an insider threat or credential-compromise scenario rather than mass exploitation. For organizations using SiYuan for sensitive knowledge management, this represents HIGH priority due to exposure of complete database contents. For general deployments with proper access controls and low-sensitivity data, risk is MEDIUM. No CISA KEV listing indicates no widespread active exploitation detected; EPSS score unavailable due to recent disclosure timeframe.

An authenticated attacker with valid SiYuan credentials logs into the web interface and crafts an HTTP request to the export endpoint using double URL-encoded path traversal sequences (e.g., /export/%252e%252e%252f%252e%252e%252fdata/storage/siyuan.db). The IsSensitivePath denylist check sees the still-encoded %252e sequences and passes validation. The redundant PathUnescape() call then decodes %252e to . (dot), allowing the attacker to traverse up directories and download the complete SQLite database containing all notes, configuration, and potentially authentication tokens. The attacker exfiltrates sensitive intellectual property, credentials, or other confidential information stored in the knowledge base.