Is CVE-2026-109309 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109309 being exploited in the wild.

How severe is CVE-2026-109309?

Medium severity, with a CVSS score of 6.5, published 12 October 2026.

Am I affected by CVE-2026-109309?

Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109309: SiYuan kernel plugin HTTP server absolute path traversal

CVE-2026-109309 · Severity: medium · CVSS 6.5 · Published 2026-10-12

SiYuan is a note-taking application with a plugin system that includes a private HTTP server for kernel plugins. Versions 3.7.0 through 3.8.5 contain a vulnerability where a malicious plugin can read arbitrary files from the host system that the SiYuan process can access, including API tokens and configuration files. An attacker who can load a compromised plugin gains immediate unauthorized file access.

Technologies: SiYuan. Vendors: SiYuan.

Quick answers

Is CVE-2026-109309 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109309 being exploited in the wild.
How severe is CVE-2026-109309?: Medium severity, with a CVSS score of 6.5, published 12 October 2026.
Which products and versions are affected?: SiYuan 3.7.0 through 3.8.5.
Is there a fix for CVE-2026-109309?: Yes: fixed in 3.8.6. Until then: Disable untrusted kernel plugins; configure bazaar.trust to false in conf.json to prevent automatic plugin loading; restrict API token access through environment variables or credential management systems. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109309 attacked?: It is in a software library.
Am I affected by CVE-2026-109309?: Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.8.6

Disable untrusted kernel plugins; configure bazaar.trust to false in conf.json to prevent automatic plugin loading; restrict API token access through environment variables or credential management systems.

Technical details

The vulnerability is an absolute path traversal in the kernel plugin private HTTP server dispatcher (kernel/plugin/service_contract.go). A kernel plugin handler can return ResponseFile.Path with an absolute file path, which is passed directly to gin.Context.File() without validation, path canonicalization, symlink checks, or allow-listing. The kernel plugin system runs with administrator privileges (RoleAdministrator JWT), and the /plugin/private/:name/*path route is only gated by authentication checks that default to admin role for localhost connections when accessAuthCode is empty. A plugin can exploit Object.seal() behavior in the JavaScript sandbox to mutate the http handler and serve arbitrary files.

Affected products

SiYuan SiYuan 3.7.0 through 3.8.5

Timeline

2026-09-24: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.