DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-GW25-M53R-QH88: GHSA-gw25-m53r-qh88: Path Traversal Bypass in SiYuan Notebook via /export/temp/ Short-Circuit Branch

#security #cve #cybersecurity #ghsa

GHSA-gw25-m53r-qh88: Path Traversal Bypass in SiYuan Notebook via /export/temp/ Short-Circuit Branch

Vulnerability ID: GHSA-GW25-M53R-QH88
CVSS Score: 6.5
Published: 2026-09-03

An incomplete mitigation in the export-handling logic of SiYuan Notebook allowed authenticated users to bypass directory traversal protections. By crafting a request with percent-encoded path navigation sequences targeting the /export/temp/ route prefix, attackers can trigger an unvalidated short-circuit block that serving arbitrary files from the host server. This bypass renders previous path-traversal mitigations ineffective for the affected endpoint.

TL;DR

A validation bypass vulnerability exists in the SiYuan Notebook server's export-handling routing branch, enabling authenticated attackers to perform arbitrary file reads on the host system via path traversal sequences.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
  • Attack Vector: Network
  • CVSS v3.1 Score: 6.5 (Medium)
  • Impact Type: Confidentiality (High)
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • SiYuan Notebook running Go Kernel version < 0.0.0-20260510110132-b763d787d1f2
  • SiYuan: < 0.0.0-20260510110132-b763d787d1f2 (Fixed in: 0.0.0-20260510110132-b763d787d1f2)

Code Analysis

Commit: b763d78

Fix path traversal bypass on export temporary directory serve branch

Commit: bb481e1

Implement initial export directory security constraints

Exploit Details

  • GitHub Security Advisory: Proof-of-Concept demonstrating directory traversal via /export/temp/ bypass to retrieve sensitive system resources.

Mitigation Strategies

  • Upgrade SiYuan to version 0.0.0-20260510110132-b763d787d1f2 or newer.
  • Restrict the binding of the SiYuan daemon to local loopback addresses (127.0.0.1).
  • Deploy Web Application Firewall rules to detect and drop URI traversal sequences targeting /export/.

Remediation Steps:

  1. Identify the current running version of the SiYuan application kernel.
  2. Pull the latest codebase updates containing patch commit b763d787d1f2b862c577049e4ee147c5857fe413.
  3. Recompile the kernel package or restart the updated containerized instance.
  4. Verify that requests with traversal payloads to /export/temp/ yield an HTTP 401/403 response.

References

Read the full report for GHSA-GW25-M53R-QH88 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)