CVE-2026-65607

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.

Summary

SiYuan's /export/ file handler was hardened against export disclosure (issue #12213) by adding an IsSubPath(exportBaseDir, fullPath) check and an IsSensitivePath() check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit branch:

if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") {
    c.File(filepath.Join(util.TempDir, c.Request.URL.Path))
    return
}

This branch joins the broader util.TempDir with the raw, percent-decoded request path and serves it with neither IsSubPath nor IsSensitivePath. An authenticated request to /export/temp/%2e%2e/.../etc/passwd traverses out of TempDir and reads arbitrary files - exactly the sensitive-file disclosure the patch intended to prevent. Present in the latest master.

Affected

• From commit bb481e1 (the hardening) through the latest master.
• Requires SiYuan access authorization (model.CheckAuth) - but the patch's stated goal is to deny sensitive-file export even to authorized callers.

Root cause

kernel/server/serve.go serveExport(): the main branch has IsSubPath + IsSensitivePath; the /export/temp/ short-circuit branch (above it) has neither and uses util.TempDir as its root. c.Request.URL.Path is percent-decoded by net/http, so %2e%2e becomes .. and filepath.Join collapses it.

Incomplete-fix lineage

• Export disclosure (issue #12213; CVE-2026-30869) -> fix bb481e1 / d68bd5a (GHSA-6865-qjcf-286f): guards on the main branch + IsSensitivePath extended to *.db/*.log.
• Follow-up CVE-2026-41894 (GHSA-hjh7-r5w8-5872) in the same /export path family.
• The /export/temp/ short-circuit branch was never covered by the guards (this report).

Proof of concept (benign)

1. Authenticate (access auth code).
2. GET /export/<sensitive> (main branch) -> 401/403 (guards work).
3. GET /export/temp/%2e%2e/%2e%2e/.../tmp/<planted-marker> (or /etc/hostname) -> 200 + file content, demonstrating the unguarded traversal. The PoC reads only a planted marker / /etc/hostname; no credentials.

Impact

Authenticated arbitrary file read bypassing the sensitive-file protection: /etc/passwd, ~/.ssh/*, SiYuan *.db workspace data, *.log.

Remediation

• Apply IsSubPath + IsSensitivePath to the /export/temp/ branch (or restrict its root to TempDir/temp with an IsSubPath check).
• filepath.Clean the request path and reject ...
• Merge both branches into one guarded file-serving function.

References

• Hardening advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f (commit d68bd5a); issue #12213.
• CVE chain: CVE-2026-30869 -> CVE-2026-41894 (GHSA-hjh7-r5w8-5872).
• serve.go guards commit: https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7
• Residual source (master): kernel/server/serve.go serveExport() lines 308-312.

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.

Summary

SiYuan's /export/ file handler was hardened against export disclosure (issue #12213) by adding an IsSubPath(exportBaseDir, fullPath) check and an IsSensitivePath() check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit branch:

if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") {
    c.File(filepath.Join(util.TempDir, c.Request.URL.Path))
    return
}

This branch joins the broader util.TempDir with the raw, percent-decoded request path and serves it with neither IsSubPath nor IsSensitivePath. An authenticated request to /export/temp/%2e%2e/.../etc/passwd traverses out of TempDir and reads arbitrary files - exactly the sensitive-file disclosure the patch intended to prevent. Present in the latest master.

Affected

• From commit bb481e1 (the hardening) through the latest master.
• Requires SiYuan access authorization (model.CheckAuth) - but the patch's stated goal is to deny sensitive-file export even to authorized callers.

Root cause

kernel/server/serve.go serveExport(): the main branch has IsSubPath + IsSensitivePath; the /export/temp/ short-circuit branch (above it) has neither and uses util.TempDir as its root. c.Request.URL.Path is percent-decoded by net/http, so %2e%2e becomes .. and filepath.Join collapses it.

Incomplete-fix lineage

• Export disclosure (issue #12213; CVE-2026-30869) -> fix bb481e1 / d68bd5a (GHSA-6865-qjcf-286f): guards on the main branch + IsSensitivePath extended to *.db/*.log.
• Follow-up CVE-2026-41894 (GHSA-hjh7-r5w8-5872) in the same /export path family.
• The /export/temp/ short-circuit branch was never covered by the guards (this report).

Proof of concept (benign)

1. Authenticate (access auth code).
2. GET /export/<sensitive> (main branch) -> 401/403 (guards work).
3. GET /export/temp/%2e%2e/%2e%2e/.../tmp/<planted-marker> (or /etc/hostname) -> 200 + file content, demonstrating the unguarded traversal. The PoC reads only a planted marker / /etc/hostname; no credentials.

Impact

Authenticated arbitrary file read bypassing the sensitive-file protection: /etc/passwd, ~/.ssh/*, SiYuan *.db workspace data, *.log.

Remediation

• Apply IsSubPath + IsSensitivePath to the /export/temp/ branch (or restrict its root to TempDir/temp with an IsSubPath check).
• filepath.Clean the request path and reject ...
• Merge both branches into one guarded file-serving function.

References

• Hardening advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f (commit d68bd5a); issue #12213.
• CVE chain: CVE-2026-30869 -> CVE-2026-41894 (GHSA-hjh7-r5w8-5872).
• serve.go guards commit: https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7
• Residual source (master): kernel/server/serve.go serveExport() lines 308-312.

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) in github.com/siyuan-note/siyuan/kernel