https://vulnerability.circl.lu/sightings/feed 2026-09-03T16:22:13.733386+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/19ae82a1-d7fc-41a7-8fc9-4172339e7a69/export 2026-09-03T16:22:13.755224+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "19ae82a1-d7fc-41a7-8fc9-4172339e7a69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6865-qjcf-286f", "type": "seen", "source": "https://gist.github.com/alon710/e3c7c4ac6e973c0fb6aac00603c26e83", "content": "# GHSA-GW25-M53R-QH88: GHSA-gw25-m53r-qh88: Path Traversal Bypass in SiYuan Notebook via /export/temp/ Short-Circuit Branch\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/GHSA-GW25-M53R-QH88\n\n## Summary\nAn incomplete mitigation in the export-handling logic of SiYuan Notebook allowed authenticated users to bypass directory traversal protections. By crafting a request with percent-encoded path navigation sequences targeting the /export/temp/ route prefix, attackers can trigger an unvalidated short-circuit block that serving arbitrary files from the host server. This bypass renders previous path-traversal mitigations ineffective for the affected endpoint.\n\n## TL;DR\nA validation bypass vulnerability exists in the SiYuan Notebook server's export-handling routing branch, enabling authenticated attackers to perform arbitrary file reads on the host system via path traversal sequences.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.5 (Medium)\n- **Impact Type**: Confidentiality (High)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Notebook running Go Kernel version < 0.0.0-20260510110132-b763d787d1f2\n- **SiYuan**: < 0.0.0-20260510110132-b763d787d1f2 (Fixed in: `0.0.0-20260510110132-b763d787d1f2`)\n\n## Mitigation\n\n- Upgrade SiYuan to version 0.0.0-20260510110132-b763d787d1f2 or newer.\n- Restrict the binding of the SiYuan daemon to local loopback addresses (127.0.0.1).\n- Deploy Web Application Firewall rules to detect and drop URI traversal sequences targeting /export/.\n\n**Remediation Steps:**\n1. Identify the current running version of the SiYuan application kernel.\n2. Pull the latest codebase updates containing patch commit b763d787d1f2b862c577049e4ee147c5857fe413.\n3. Recompile the kernel package or restart the updated containerized instance.\n4. Verify that requests with traversal payloads to /export/temp/ yield an HTTP 401/403 response.\n\n## References\n\n- [GitHub Security Advisory GHSA-gw25-m53r-qh88](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gw25-m53r-qh88)\n- [SiYuan Vulnerability Fix Commit](https://github.com/siyuan-note/siyuan/commit/b763d787d1f2b862c577049e4ee147c5857fe413)\n- [SiYuan Historical Directory Traversal Advisory](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-GW25-M53R-QH88) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T15:32:02.673191Z"} 2026-09-03T15:32:02.673191+00:00