Junglewise Threat Intelligence

CVE-2026-59832: SiYuan path traversal in serveSnippets route handler

CVE-2026-59832 · Severity: high · CVSS 7.7 · Published 2026-07-09

Technologies: SiYuan Note SiYuan, SiYuan, github.com/siyuan-note/siyuan/kernel (Go). Vendors: SiYuan Note, SiYuan, Go.

Executive brief

Siyuan's snippets handler allows authenticated users (including non-admins with limited roles) to read sensitive workspace files through path-traversal attacks. An attacker can obtain the kernel API token and access code by requesting a specially crafted URL, then use those secrets to gain full administrative control of the note-taking system. The handler also exposes the entire document database and any files on the host system accessible to the Siyuan process.

Technical details

The /snippets/*filepath route handler in kernel/server/serve.go performs an unconstrained filepath.Join(util.SnippetsPath, filePath) on user-controlled input extracted from c.Request.URL.Path (which has been percent-decoded once by the Go net/http layer). The handler lacks both IsSubPath() confinement checks and IsSensitivePath() denylisting—controls present in sibling handlers like /export/ and /appearance/. A non-admin guard only blocks the literal string "conf.json" but not traversal variants like "../../conf/conf.json", so it is easily bypassed. When the attacker requests GET /snippets/%2e%2e/%2e%2e/conf/conf.json, the path is decoded to ../../conf/conf.json, passed through filepath.Join which resolves .. segments, and served via c.File() without bounds checking. This resolves to WorkspaceDir/conf/conf.json (the secret file containing the API token and AccessAuthCode) or WorkspaceDir/temp/siyuan.db (the full database). The vulnerability requires only authentication (model.CheckAuth middleware), which includes any API token, valid session with AccessAuthCode, or BasicAuth—not admin role—making it accessible to non-admin users in shared/published workspace modes.

Affected products

  • siyuan-note siyuan <=3.6.5

Timeline

  • 2026-07-02: disclosed
  • 2026-07-04: patched: Patched in commit 68cc0f537dfa (v3.7.1)
  • 2026-09-02: advisory

References

Related threats