Executive brief
SiYuan, an open-source personal knowledge management system, contains a security flaw that allows authenticated administrators or users with API tokens to access sensitive files on the host server. By exploiting an incomplete security filter, an attacker can copy private credential files—such as Git tokens, Docker configurations, and Kubernetes keys—into the application's workspace and then download them. This could lead to a full compromise of the user's external accounts and cloud infrastructure.
Technical details
The vulnerability exists in the `POST /api/file/globalCopyFiles` endpoint, which accepts absolute source paths from the user. The application relies on a denylist-based protection mechanism, `util.IsSensitivePath` in `kernel/util/path.go`, to prevent access to sensitive system files. However, this denylist is incomplete and fails to include common home-directory credential files such as `.git-credentials`, `.netrc`, `.pgpass`, `.kube/config`, and `.docker/config.json`. An authenticated attacker with administrator privileges or a valid API token can use this endpoint to copy these sensitive files into the SiYuan workspace and subsequently exfiltrate them using the `getFile` API. The issue is further exacerbated by a lack of workspace confinement and symlink resolution for source paths. The vulnerability is fixed in version 3.7.1 by improving path validation and symlink handling.
Affected products
- siyuan-note SiYuan < 3.7.1
Timeline
- 2026-07-02: advisory: GitHub Security Advisory GHSA-vmm8-3ccv-ppvw published
- 2026-07-04: patched: Version 3.7.1 released
- 2026-07-09: disclosed: CVE-2026-59854 published to NVD
References
- https://github.com/siyuan-note/siyuan/commit/914c5180a88d17f6d38716a56483327b367ef55f
- https://github.com/siyuan-note/siyuan/commit/b54fee401799d987d2fd2888220938ad599b8c5e
- https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vmm8-3ccv-ppvw