Vulnerability Database

413,619

Total vulnerabilities in the database

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) — github.com/siyuan-note/siyuan/kernel

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

SiYuan's /export/ file handler was hardened against export disclosure (issue #12213) by adding an IsSubPath(exportBaseDir, fullPath) check and an IsSensitivePath() check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit branch:

if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") { c.File(filepath.Join(util.TempDir, c.Request.URL.Path)) return }

This branch joins the broader util.TempDir with the raw, percent-decoded request path and serves it with neither IsSubPath nor IsSensitivePath. An authenticated request to /export/temp/%2e%2e/.../etc/passwd traverses out of TempDir and reads arbitrary files - exactly the sensitive-file disclosure the patch intended to prevent. Present in the latest master.

Affected

  • From commit bb481e1 (the hardening) through the latest master.
  • Requires SiYuan access authorization (model.CheckAuth) - but the patch's stated goal is to deny sensitive-file export even to authorized callers.

Root cause

kernel/server/serve.go serveExport(): the main branch has IsSubPath + IsSensitivePath; the /export/temp/ short-circuit branch (above it) has neither and uses util.TempDir as its root. c.Request.URL.Path is percent-decoded by net/http, so %2e%2e becomes .. and filepath.Join collapses it.

Incomplete-fix lineage

  • Export disclosure (issue #12213; CVE-2026-30869) -> fix bb481e1 / d68bd5a (GHSA-6865-qjcf-286f): guards on the main branch + IsSensitivePath extended to *.db/*.log.
  • Follow-up CVE-2026-41894 (GHSA-hjh7-r5w8-5872) in the same /export path family.
  • The /export/temp/ short-circuit branch was never covered by the guards (this report).

Proof of concept (benign)

  1. Authenticate (access auth code).
  2. GET /export/<sensitive> (main branch) -> 401/403 (guards work).
  3. GET /export/temp/%2e%2e/%2e%2e/.../tmp/<planted-marker> (or /etc/hostname) -> 200 + file content, demonstrating the unguarded traversal. The PoC reads only a planted marker / /etc/hostname; no credentials.

Impact

Authenticated arbitrary file read bypassing the sensitive-file protection: /etc/passwd, ~/.ssh/*, SiYuan *.db workspace data, *.log.

Remediation

  • Apply IsSubPath + IsSensitivePath to the /export/temp/ branch (or restrict its root to TempDir/temp with an IsSubPath check).
  • filepath.Clean the request path and reject ...
  • Merge both branches into one guarded file-serving function.

References

  • Hardening advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f (commit d68bd5a); issue #12213.
  • CVE chain: CVE-2026-30869 -> CVE-2026-41894 (GHSA-hjh7-r5w8-5872).
  • serve.go guards commit: https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7
  • Residual source (master): kernel/server/serve.go serveExport() lines 308-312.
  • Published: Sep 3, 2026
  • Updated: Sep 4, 2026
  • GHSA: GHSA-gw25-m53r-qh88
  • Severity: Medium
  • Exploit:
  • CISA KEV:

CVSS v3:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWEs:

OWASP TOP 10:

Software Affected versions
Go icon github.com/siyuan-note/siyuan/kernel < 0.0.0-20260510110132-b763d787d1f2

Is kernel exposed on your perimeter?

A vulnerability database tells you what is broken. Attack surface management tells you where it is running: it discovers your internet-facing assets and flags the ones affected by issues like this one.

What is attack surface management? →

Frequently Asked Questions

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.