CVE-2026-54066: SiYuan Path Traversal – Unauthenticated File Read in Publish Mode

Technical summary

CVE-2026-54066 is a path traversal vulnerability (CWE-22, CWE-23, CWE-1188) in SiYuan's /assets/*path route that persists after an incomplete patch to CVE-2026-41894. The vulnerability exploits insufficient normalization of double-URL-encoded path separators (%252e%252e representing ..), allowing traversal out of the intended assets directory. When SiYuan runs in publish mode on the default port 6808—an unauthenticated, anonymous HTTP endpoint—an attacker can retrieve WorkspaceDir contents including conf/conf.json (which stores AccessAuthCode SHA256 hashes, API tokens, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log. No authentication, user interaction, or network complexity is required; the attack surface is maximized in the default publish mode configuration.

Business impact

Compromise of conf/conf.json exposes authentication credentials and sync keys, potentially enabling lateral movement to linked devices or cloud synchronization targets. Exfiltration of database files (siyuan.db, blocktree.db) reveals the complete personal knowledge base contents, representing data loss and privacy breach. Log files may contain additional sensitive context. Organizations and individuals using SiYuan for sensitive note-taking, research, or configuration management face immediate confidentiality loss. The default publish mode deployment pattern—intended for sharing read-only notebooks—becomes a vector for insider reconnaissance or external attacks if firewall controls are inadequate.

Affected systems

SiYuan versions prior to 3.7.0 are affected. The vulnerability is exposed when publish mode is enabled (default port 6808). Systems with network access to the publish endpoint—whether internal or internet-facing—are at risk. Air-gapped or strictly firewall-isolated deployments reduce exposure, but organizations relying on network segmentation alone without patching remain vulnerable.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and no special network conditions (CVSS vector: AV:N/AC:L/PR:N/UI:N). An attacker can craft HTTP requests with double-URL-encoded path sequences from any network vantage point. Tools like curl or a web browser are sufficient to attempt exploitation. The barrier to weaponization is low; no security research, specialized exploit development, or zero-day knowledge is needed. Public disclosure of the root cause (incomplete patch of CVE-2026-41894) further accelerates exploitation risk.

Remediation

Upgrade SiYuan to version 3.7.0 or later, which fixes the /assets/ route path traversal. Immediate mitigations pending patch deployment include: (1) disabling publish mode if not required, (2) restricting network access to port 6808 via firewall rules (limit to trusted networks only), (3) moving the listen port behind a reverse proxy with strict request filtering, and (4) monitoring logs for suspicious /assets/ requests with encoded path segments. Users should audit recent logs for indicators of exploitation.

Patch guidance

Update to SiYuan 3.7.0 immediately. Verify the release notes confirm the /assets/ route sanitization fix. Test the patch in a non-production environment to ensure no configuration regression. After patching, rotate AccessAuthCode and API tokens stored in conf/conf.json as a precaution, since they may have been exposed. Verify firewall rules blocking or limiting access to port 6808 remain in place during the patching window.

Detection guidance

Monitor HTTP access logs for requests to /assets/ containing double-URL-encoded patterns: %252e%252e, %252f, or similar sequences. Alert on any request attempting to traverse above the expected assets directory (e.g., requests seeking ../ or conf/, temp/, or .db/.log files). Implement request filtering at the reverse proxy layer to reject or sanitize payloads with double-encoding. Check system logs and file access logs for unauthorized reads of conf/conf.json, siyuan.db, blocktree.db, or siyuan.log files. Review recent siyuan.log entries for suspicious access patterns or error messages indicating traversal attempts.

Why prioritize this

This vulnerability scores CVSS 7.5 (HIGH) and poses immediate confidentiality risk to sensitive personal knowledge bases and authentication materials. The combination of unauthenticated access, default port exposure, low attack complexity, and high-value targets (credential and database files) makes it a priority for patching. Organizations relying on SiYuan for any confidential information should treat this as urgent. The incomplete nature of the previous patch (CVE-2026-41894) suggests a systemic path-handling weakness that may warrant deeper code review.

Risk score, explained

CVSS 7.5 reflects the high confidentiality impact (C:H) balanced against no integrity or availability harm. The score emphasizes that while attackers cannot modify or delete data, they can freely exfiltrate sensitive configuration and personal content. The network-accessible attack vector, absence of authentication requirements, and low complexity push the score into the HIGH severity range. In organizational context, the actual risk may be higher if exposed systems hold regulated data (PII, trade secrets, healthcare records), which would justify elevating response priority beyond the base CVSS.

Frequently asked questions