{"uuid": "bb083df9-ffa5-478e-b573-e8e357958750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3cm4-ccvw-6xr6", "type": "seen", "source": "https://gist.github.com/alon710/068e5f4edf9576ff4aa9bbe5e5c048d2", "content": "# GHSA-3CM4-CCVW-6XR6: GHSA-3cm4-ccvw-6xr6: Weak Path Access Control and History/Repo-Diff Endpoint Bypass in SiYuan\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/GHSA-3CM4-CCVW-6XR6\n\n## Summary\nA weak path access control vulnerability in SiYuan note-taking application allowed authenticated users to bypass restricted file paths by requesting historical backups and git diffs of sensitive configurations, including plain-text authentication tokens.\n\n## TL;DR\nWeak relative path checks in SiYuan allowed standard users to access sensitive configuration files and publishing tokens by requesting them via unprotected history and git diff endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization) / CWE-22 (Path Traversal)\n- **Attack Vector**: Network (Authenticated Standard User or Local API Access)\n- **CVSS v3.1**: 7.5 (Medium-High)\n- **Exploit Status**: Proof-of-Concept (PoC) Analyzed\n- **Impact**: Information Disclosure (Retrieval of plain-text publishing tokens and templates)\n- **Remediation**: Upgrade to v3.8.1 or higher\n\n## Affected Systems\n\n- SiYuan personal knowledge management system\n- **SiYuan**: < 3.8.1 (Fixed in: `v3.8.1`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.8.1 or later.\n- Implement network binding constraints to limit API access to localhost.\n- Deploy reverse-proxy level URL filtering blocks for sensitive paths.\n\n**Remediation Steps:**\n1. Navigate to the official SiYuan release page at https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1.\n2. Download the verified v3.8.1 binaries corresponding to your environment's operating system.\n3. Stop the running SiYuan application instance.\n4. Replace the existing binaries with the updated v3.8.1 version.\n5. Restart the application and verify path blocks are active by attempting to query `/history/` elements containing sensitive paths.\n\n## References\n\n- [SiYuan Release v3.8.1 Announcement](https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-3CM4-CCVW-6XR6) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-05T19:30:32.000000Z"}