Executive brief
SiYuan is a note-taking and knowledge management application. An authenticated administrator can exploit a path traversal vulnerability in the HTML export endpoint to write malicious HTML files outside the workspace directory, potentially leading to defacement of web content or stored cross-site scripting (XSS) attacks against users who access the affected files.
Technical details
The exportBrowserHTML endpoint in kernel/api/export.go fails to validate the folder parameter for directory traversal sequences, allowing an authenticated administrator to escape the export directory using ".." path components. An attacker can write arbitrary, unfiltered HTML/JavaScript content to index.html in any pre-existing kernel-writable location by supplying a traversal payload in the folder field, bypassing the encrypted-box validation which only applies when the path component is a valid NodeID pattern.
Affected products
- SiYuan SiYuan before v3.8.4
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: v3.8.4 released
- 2026-09-26: advisory