Is CVE-2026-126776 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126776 being exploited in the wild.

How severe is CVE-2026-126776?

Medium severity, with a CVSS score of 5.3, published 11 November 2026.

Which products and versions are affected?

SiYuan 3.7.0 to 3.8.9 on Windows.

Is there a fix for CVE-2026-126776?

Yes: fixed in SiYuan 3.8.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126776 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126776?

Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126776: SiYuan path traversal in web fetch

CVE-2026-126776 · Severity: medium · CVSS 5.3 · Published 2026-11-11

SiYuan is a personal knowledge management application that includes tools to fetch content from web URLs. A path traversal vulnerability in versions 3.7.0 through 3.8.9 on Windows allows attackers who control a URL fetched by the application to write files to any directory writable by the SiYuan user, potentially enabling arbitrary file write attacks or system compromise.

Technologies: SiYuan. Vendors: SiYuan.

Quick answers

Is CVE-2026-126776 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126776 being exploited in the wild.
How severe is CVE-2026-126776?: Medium severity, with a CVSS score of 5.3, published 11 November 2026.
Which products and versions are affected?: SiYuan 3.7.0 to 3.8.9 on Windows.
Is there a fix for CVE-2026-126776?: Yes: fixed in SiYuan 3.8.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126776 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126776?: Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SiYuan 3.8.10

Technical details

The vulnerability exists in kernel/util/webfetch.go where filename extraction fails to properly validate backslash-encoded sequences (%5C) on Windows before writing downloaded files. An attacker controlling a fetched URL can craft responses with %5C-encoded ..\ sequences in the Content-Disposition filename or URL to traverse outside the intended temp/import directory. This affects the MCP web_fetch and http_request tools when handling non-HTML/non-text file downloads.

Affected products

SiYuan SiYuan 3.7.0 to 3.8.9 on Windows

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.