{"id":"CVE-2026-65607","aliases":["EUVD-2026-48243","GHSA-2vq9-c755-fq2h","GHSA-gw25-m53r-qh88","GO-2026-6365"],"status":"published","title":"SiYuan before v3.7.2 Path Traversal via /export/temp/","description":"SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00586,"percentile":0.48349,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-07-23T11:42:14Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","fixed_in":["0.0.0-20260510110132-b763d787d1f2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20260510110132-b763d787d1f2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260510110132-b763d787d1f2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260510110132-b763d787d1f2"}]}]}],"products":[{"vendor":"siyuan-note","product":"siyuan"}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gw25-m53r-qh88","tags":["vendor-advisory","advisory","web"]},{"url":"https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7","tags":["patch","fix"]},{"url":"https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-export-temp","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65607","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2vq9-c755-fq2h"},{"url":"https://github.com/siyuan-note/siyuan/commit/b763d787d1f2b862c577049e4ee147c5857fe413","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gw25-m53r-qh88"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65607.json","tags":["advisory"]},{"url":"https://github.com/siyuan-note/siyuan","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-65607","title":"SiYuan before v3.7.2 Path Traversal via /export/temp/","description":"SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.","status":"published","published":"2026-07-23T11:42:14.89Z","modified":"2026-10-08T15:23:57.946Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:37:13.934727Z"}],"euvd":[{"id":"EUVD-2026-48243","description":"SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.","status":"published","published":"2026-07-23T11:42:14Z","modified":"2026-10-08T15:23:57Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:31.696571Z"}],"ghsa":[{"id":"GHSA-2vq9-c755-fq2h","title":"SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit...","description":"SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.","status":"published","published":"2026-07-23T12:32:30Z","modified":"2026-07-23T12:32:55Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:09:41.900753Z"},{"id":"GHSA-gw25-m53r-qh88","title":"SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)","description":"## Summary\nSiYuan's `/export/` file handler was hardened against export disclosure (issue #12213) by adding an\n`IsSubPath(exportBaseDir, fullPath)` check and an `IsSensitivePath()` check in commit `bb481e1`. These guards\nwere added only to the main branch of the handler. The handler begins with a short-circuit branch:\n```go\nif strings.HasPrefix(c.Request.URL.Path, \"/export/temp/\") {\n    c.File(filepath.Join(util.TempDir, c.Request.URL.Path))\n    return\n}\n```\nThis branch joins the **broader** `util.TempDir` with the raw, percent-decoded request path and serves it with\n**neither** `IsSubPath` **nor** `IsSensitivePath`. An authenticated request to\n`/export/temp/%2e%2e/.../etc/passwd` traverses out of `TempDir` and reads arbitrary files - exactly the\nsensitive-file disclosure the patch intended to prevent. Present in the latest master.\n\n## Affected\n- From commit `bb481e1` (the hardening) through the latest master.\n- Requires SiYuan access authorization (`model.CheckAuth`) - but the patch's stated goal is to deny sensitive-file\n  export even to authorized callers.\n\n## Root cause\n`kernel/server/serve.go` `serveExport()`: the main branch has `IsSubPath` + `IsSensitivePath`; the\n`/export/temp/` short-circuit branch (above it) has neither and uses `util.TempDir` as its root.\n`c.Request.URL.Path` is percent-decoded by net/http, so `%2e%2e` becomes `..` and `filepath.Join` collapses it.\n\n## Incomplete-fix lineage\n- Export disclosure (issue #12213; CVE-2026-30869) -\u003e fix `bb481e1` / `d68bd5a` (GHSA-6865-qjcf-286f): guards on\n  the main branch + `IsSensitivePath` extended to `*.db`/`*.log`.\n- Follow-up CVE-2026-41894 (GHSA-hjh7-r5w8-5872) in the same `/export` path family.\n- The `/export/temp/` short-circuit branch was never covered by the guards (this report).\n\n## Proof of concept (benign)\n1. Authenticate (access auth code).\n2. `GET /export/\u003csensitive\u003e` (main branch) -\u003e 401/403 (guards work).\n3. `GET /export/temp/%2e%2e/%2e%2e/.../tmp/\u003cplanted-marker\u003e` (or `/etc/hostname`) -\u003e 200 + file content,\n   demonstrating the unguarded traversal. The PoC reads only a planted marker / `/etc/hostname`; no credentials.\n\n## Impact\nAuthenticated arbitrary file read bypassing the sensitive-file protection: `/etc/passwd`, `~/.ssh/*`, SiYuan\n`*.db` workspace data, `*.log`. \n\n## Remediation\n- Apply `IsSubPath` + `IsSensitivePath` to the `/export/temp/` branch (or restrict its root to `TempDir/temp` with\n  an `IsSubPath` check).\n- `filepath.Clean` the request path and reject `..`.\n- Merge both branches into one guarded file-serving function.\n\n## References\n- Hardening advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f (commit d68bd5a); issue #12213.\n- CVE chain: CVE-2026-30869 -\u003e CVE-2026-41894 (GHSA-hjh7-r5w8-5872).\n- serve.go guards commit: https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7\n- Residual source (master): `kernel/server/serve.go` `serveExport()` lines 308-312.","status":"published","published":"2026-09-03T14:56:31Z","modified":"2026-09-03T14:56:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:11.621873Z"}],"nvd":[{"id":"CVE-2026-65607","description":"SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.","status":"published","published":"2026-07-23T12:18:47.633Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"CVE-2026-65607","title":"SiYuan before v3.7.2 Path Traversal via /export/temp/","description":"SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.","status":"published","published":"2026-07-23T11:42:14.89Z","modified":"2026-10-28T02:30:58.219357675Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:14.096824Z"},{"id":"GHSA-gw25-m53r-qh88","title":"SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)","description":"## Summary\nSiYuan's `/export/` file handler was hardened against export disclosure (issue #12213) by adding an\n`IsSubPath(exportBaseDir, fullPath)` check and an `IsSensitivePath()` check in commit `bb481e1`. These guards\nwere added only to the main branch of the handler. The handler begins with a short-circuit branch:\n```go\nif strings.HasPrefix(c.Request.URL.Path, \"/export/temp/\") {\n    c.File(filepath.Join(util.TempDir, c.Request.URL.Path))\n    return\n}\n```\nThis branch joins the **broader** `util.TempDir` with the raw, percent-decoded request path and serves it with\n**neither** `IsSubPath` **nor** `IsSensitivePath`. An authenticated request to\n`/export/temp/%2e%2e/.../etc/passwd` traverses out of `TempDir` and reads arbitrary files - exactly the\nsensitive-file disclosure the patch intended to prevent. Present in the latest master.\n\n## Affected\n- From commit `bb481e1` (the hardening) through the latest master.\n- Requires SiYuan access authorization (`model.CheckAuth`) - but the patch's stated goal is to deny sensitive-file\n  export even to authorized callers.\n\n## Root cause\n`kernel/server/serve.go` `serveExport()`: the main branch has `IsSubPath` + `IsSensitivePath`; the\n`/export/temp/` short-circuit branch (above it) has neither and uses `util.TempDir` as its root.\n`c.Request.URL.Path` is percent-decoded by net/http, so `%2e%2e` becomes `..` and `filepath.Join` collapses it.\n\n## Incomplete-fix lineage\n- Export disclosure (issue #12213; CVE-2026-30869) -\u003e fix `bb481e1` / `d68bd5a` (GHSA-6865-qjcf-286f): guards on\n  the main branch + `IsSensitivePath` extended to `*.db`/`*.log`.\n- Follow-up CVE-2026-41894 (GHSA-hjh7-r5w8-5872) in the same `/export` path family.\n- The `/export/temp/` short-circuit branch was never covered by the guards (this report).\n\n## Proof of concept (benign)\n1. Authenticate (access auth code).\n2. `GET /export/\u003csensitive\u003e` (main branch) -\u003e 401/403 (guards work).\n3. `GET /export/temp/%2e%2e/%2e%2e/.../tmp/\u003cplanted-marker\u003e` (or `/etc/hostname`) -\u003e 200 + file content,\n   demonstrating the unguarded traversal. The PoC reads only a planted marker / `/etc/hostname`; no credentials.\n\n## Impact\nAuthenticated arbitrary file read bypassing the sensitive-file protection: `/etc/passwd`, `~/.ssh/*`, SiYuan\n`*.db` workspace data, `*.log`. \n\n## Remediation\n- Apply `IsSubPath` + `IsSensitivePath` to the `/export/temp/` branch (or restrict its root to `TempDir/temp` with\n  an `IsSubPath` check).\n- `filepath.Clean` the request path and reject `..`.\n- Merge both branches into one guarded file-serving function.\n\n## References\n- Hardening advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f (commit d68bd5a); issue #12213.\n- CVE chain: CVE-2026-30869 -\u003e CVE-2026-41894 (GHSA-hjh7-r5w8-5872).\n- serve.go guards commit: https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7\n- Residual source (master): `kernel/server/serve.go` `serveExport()` lines 308-312.","status":"published","published":"2026-09-03T14:56:31Z","modified":"2026-09-10T15:25:39.483357072Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"GO-2026-6365","title":"SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) in github.com/siyuan-note/siyuan/kernel","status":"published","published":"2026-09-10T14:48:42Z","modified":"2026-09-10T15:25:39.483357072Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}