Executive brief
SiYuan is a local-first knowledge management application that stores user data in a workspace with enforced boundaries. A path traversal vulnerability in the checkoutRepo API endpoint allows authenticated administrators to write JSON files outside the workspace boundary by manipulating the sessionID parameter. This could enable attackers to overwrite configuration or state files in other workspaces or shared directories, potentially corrupting data or causing service disruption.
Technical details
The checkoutRepo endpoint in kernel/api/repo.go binds the sessionID parameter without validation, then uses it to construct a file path via filepath.Join that gets written to disk. An attacker can inject directory traversal sequences (e.g., "../../") in the sessionID to escape the intended marker directory and write files to arbitrary pre-existing kernel-writable directories outside the workspace. The vulnerability requires admin privileges and network access to the API endpoint; the parent directory of the target file must already exist for the write to succeed.
Affected products
- siyuan-note SiYuan before 3.8.4
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Version 3.8.4