Executive brief
SiYuan, a personal knowledge management system, contains a vulnerability in its 'publish mode' that allows unauthorized users to read sensitive files from the server. By sending specially crafted web requests, an attacker can bypass security restrictions to access configuration files, database backups, and internal logs. This could lead to the theft of private notebooks, API tokens, and cloud synchronization credentials, potentially allowing full control over the user's data.
Technical details
A path traversal vulnerability exists in SiYuan's kernel due to an incomplete fix for a previous issue. The `/assets/*path` route performs a second `url.PathUnescape` as a fallback mechanism, which allows double-encoded '..' segments (e.g., %252e%252e) to bypass initial security filters. Furthermore, the `CheckAbsPathAccessableByPublishAccess` function incorrectly permits access to files outside the data directory but within the broader workspace directory. An unauthenticated remote attacker can exploit this to read sensitive files such as `conf/conf.json` (containing API tokens and sync keys) and SQLite database files. The vulnerability is patched in version 0.0.0-20260628153353-2d5d72223df4 by removing the redundant unescape fallback and tightening path validation.
Affected products
- siyuan-note SiYuan < 0.0.0-20260628153353-2d5d72223df4
Timeline
- 2026-06-03: disclosed: Reported to vendor via GitHub Security Advisory
- 2026-06-24: advisory: NVD published CVE-2026-54066
- 2026-07-10: advisory: GitHub Advisory published/reviewed
References
- https://api.github.com/users/aslein1413-sys
- https://github.com/aslein1413-sys
- https://api.github.com/users/aslein1413-sys/gists%7B/gist_id%7D
- https://api.github.com/users/aslein1413-sys/repos
- https://avatars.githubusercontent.com/u/247496863?v=4
- https://api.github.com/users/aslein1413-sys/events%7B/privacy%7D