EUVD-2026-42744
GHSA-275h-v5h9-vr82
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Authenticated path traversal in SiYuan personal knowledge management system (versions prior to 3.7.1) lets a low-privileged user read arbitrary workspace files by abusing the /snippets/*filepath handler. Because serveSnippets in kernel/server/serve.go single-decodes the request path and joins it to the snippets directory without containment or sensitive-file checks, a request like /snippets/%2e%2e/%2e%2e/conf/conf.json returns workspace secrets and the document database. No public exploit identified at time of analysis, though the fixing commit publicly reveals the vulnerable code path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Siyuan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticated request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to read workspace secrets and the document database. This issue is fixed in versions 3.7.1.
Executive ViewAI
SiYuan personal knowledge management system versions prior to 3.7.1 contain an authenticated path traversal vulnerability allowing low-privileged users to read arbitrary workspace files, including configuration data and document databases. Organizations storing sensitive information in SiYuan face direct exposure of workspace secrets and potentially confidential documents. Immediate upgrade to version 3.7.1 or later is required to prevent unauthorized data access.
Within 24 hours: Inventory all SiYuan installations and identify systems running versions prior to 3.7.1; implement network-level access restrictions as interim protection. Within 7 days: Upgrade all affected SiYuan instances to version 3.7.1 or later. Within 30 days: Audit system logs for exploitation attempts (malicious requests to /snippets endpoint with traversal sequences like %2e%2e); rotate workspace secrets if unauthorized access is detected.
Apply vendor patch: upgrade to SiYuan version 3.7.1 or later. Interim mitigation: restrict network access to SiYuan instances and disable or rate-limit the /snippets API endpoint pending patching.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
SQL injection in SiYuan's fullTextSearchAssetContent endpoint lets unauthenticated attackers and holders of publish Role
Stored cross-site scripting in SiYuan personal knowledge management before 3.7.0 lets an attacker with write access to a
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
Stored cross-site scripting in SiYuan's attribute-view (database) cell renderer, affecting all versions prior to 3.7.0,
SQL injection in SiYuan personal knowledge-management software (all versions before v3.7.3) lets attackers inject arbitr
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Remote code execution in SiYuan note-taking application (before v3.6.1) allows any malicious Bazaar marketplace package
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB