EUVD-2026-63898
GHSA-w7g2-952j-gmgr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API but requires admin (PR:H); traversal escapes the app directory to affect the host OS, so scope changes to S:C with full write/delete leading to RCE-grade C/I/A:H.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.
AnalysisAI
Arbitrary file write and recursive directory deletion in SiYuan note-taking application before v3.7.4 stems from missing validation of the packageName parameter in the Bazaar marketplace install and uninstall endpoints. An authenticated administrator can supply directory-traversal sequences to write files to any filesystem location (install) or recursively delete arbitrary directories (uninstall), enabling remote code execution and destructive impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated administrator session on the target SiYuan instance (CVSS PR:H) and network reachability to its HTTP API; exploitation is performed by sending crafted packageName values containing directory-traversal sequences to the Bazaar install (arbitrary file write) or uninstall (recursive directory delete) endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 9.4 (AV:N/AC:L/AT:N/PR:H/UI:N with high vulnerable- and subsequent-system impact) reflects that exploitation is network-borne and low-complexity but gated behind PR:H - the attacker must already hold administrator privileges on the SiYuan instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained SiYuan administrator credentials (e.g., via phishing, credential reuse, or an exposed default/weak login) sends a crafted Bazaar install request whose packageName contains '../' sequences, writing a malicious file such as a shell startup script, cron entry, or web-served payload to a sensitive location to achieve code execution. Alternatively, they call the uninstall endpoint with a traversal path to recursively delete critical directories, causing destructive denial of service. … |
| Remediation | Upgrade to SiYuan v3.7.4 or later, which contains the fix (Vendor-released patch: v3.7.4). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SiYuan deployments and immediately restrict administrator account access to only essential personnel, disabling Bazaar marketplace functionality at the application level if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today