SiYuan Note EUVD-2026-97611

Exploitation requires the victim to install and load an attacker-supplied malicious SiYuan kernel plugin; there is no exploitation against a default install without such a plugin. Given a malicious plugin, its private HTTP server sets the plugin handler's ResponseFile.Path to an absolute path pointing outside the SiYuan workspace, which the unpatched kernel passes directly to gin's Context.File/FileAttachment without workspace-boundary validation, disclosing any file readable by the SiYuan process (notably the API token and conf.json). The key limiting factor is the required user action of trusting and installing an untrusted third-party plugin; the patched version rejects paths that resolve outside util.WorkspaceDir and returns 404 to prevent probing.

The CVSS 4.0 base score of 6.9 (Medium) and the PR:N (no privileges) metric superficially suggest an unauthenticated network-exploitable flaw, but this is misleading: the vector sets UI:A (active user interaction), reflecting the description's hard precondition that an attacker must get a victim to install and run a malicious kernel plugin. Technical impact is high and narrow - VC:H with VI:N/VA:N means confidentiality-only arbitrary file read (including the SiYuan API token and conf.json, which can enable subsequent full-API compromise), with no integrity or availability impact. No EPSS score, KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active or automatable exploitation; the flaw is not mass-scannable because it requires the plugin-installation step rather than a direct unauthenticated request. Net assessment: a genuinely impactful bug for users who install untrusted third-party plugins, but a lower real-world priority than the network vector alone implies - realistic risk is gated by social engineering, not by raw CVSS.

An attacker publishes a seemingly legitimate SiYuan kernel plugin and convinces a target to install it. Once loaded, the plugin's private HTTP server returns a ResponseFile.Path pointing to an absolute path outside the workspace (e.g. the API token file or conf.json), which the kernel serves verbatim via gin's Context.File, letting the attacker-controlled plugin read and exfiltrate any file readable by the SiYuan process. No public exploit identified at time of analysis.