CVE-2026-59832: SiYuan Path Traversal Vulnerability – Secrets Disclosure

Technical summary

The /snippets/*filepath route handler in kernel/server/serve.go performs single-level URL decoding of the request path before joining it with the snippets directory root. This insufficient decoding fails to prevent double-encoded traversal sequences (e.g., %2e%2e for ..) from bypassing the intended directory boundary. The handler lacks both subpath containment validation and explicit sensitive-path filtering, allowing authenticated requests to traverse upward through the directory tree. An attacker can craft requests such as /snippets/%2e%2e/%2e%2e/conf/conf.json to access files outside the snippets directory, including configuration files containing workspace secrets and the backing database used for document storage.

Business impact

Any organization or individual using SiYuan prior to 3.7.1 faces risk of unauthorized disclosure of sensitive workspace configuration and document data. An insider threat or compromised account with SiYuan access can extract secrets, API keys, or database contents without requiring additional system-level privileges. For multi-user deployments or shared knowledge bases, this can expose proprietary information, credentials, or personal data stored within the knowledge management system. The impact is compounded in environments where SiYuan is integrated with external services or contains business-critical documentation.

Affected systems

SiYuan versions prior to 3.7.1 are affected. The vulnerability requires authentication; unauthenticated users cannot exploit it. Affected deployments include self-hosted SiYuan instances and any installations running versions below 3.7.1, whether deployed on-premises, in containers, or as a service.

Exploitability

Exploitability is moderate-to-high given the low access complexity. An attacker must possess valid SiYuan credentials, but once authenticated, no user interaction is needed to craft and execute a malicious request. The attack is straightforward: encode path traversal sequences and request them via the vulnerable endpoint. Tools required are minimal—a standard HTTP client suffices. The attack is reliable and repeatable across instances running vulnerable versions.

Remediation

Upgrade SiYuan to version 3.7.1 or later. The patch address the underlying path-handling flaw by implementing proper subpath containment checks and rejecting requests that attempt to traverse outside the intended directory. After upgrading, verify that no unauthorized files were accessed by reviewing access logs and confirming the integrity of configuration files and databases.

Patch guidance

Deploy version 3.7.1 or later as soon as feasible. If immediate patching is not possible, consider restricting network access to SiYuan to trusted networks or IP ranges, and audit account permissions to minimize the number of users with access to the application. Monitor for suspicious requests containing path-traversal patterns in access logs. Verify against the official SiYuan release notes to confirm the exact version requirements for your deployment.

Detection guidance

Search access logs for requests to /snippets/ containing URL-encoded traversal sequences such as %2e%2e, %252e, or similar patterns. Monitor for requests accessing paths outside the expected snippets directory structure. Implement Web Application Firewall (WAF) rules to block requests with suspicious path traversal indicators. If SiYuan includes audit logging, check for access patterns suggesting file enumeration or discovery attempts by authenticated users. Compare configuration file modification timestamps against known maintenance windows to detect unauthorized changes.

Why prioritize this

This vulnerability merits high priority because it enables authenticated compromise of sensitive data at scale within a knowledge management system. The CVSS score of 7.7 reflects the combination of high confidentiality impact, low attack complexity, and the cross-boundary scope of potential exposure (affecting not just the user's own workspace but potentially shared configurations). While exploitation requires authentication, the ease of crafting requests and the value of targets (secrets, databases) make it an attractive target for insiders or users with compromised credentials. The lack of KEV designation does not diminish the risk in environments where SiYuan is trusted with sensitive information.

Risk score, explained

The CVSS:3.1 score of 7.7 (HIGH) reflects: Network-accessible vector (AV:N) with low attack complexity (AC:L), requiring legitimate credentials (PR:L). The vulnerability carries high confidentiality impact (C:H)—an attacker can read arbitrary files—with no integrity or availability impact (I:N, A:N). The scope change (S:C) indicates the vulnerability can affect resources beyond the vulnerable component (workspace secrets and database files). This scoring appropriately elevates the threat level from a simple file-read to a high-priority data disclosure risk in authenticated scenarios.

Frequently asked questions