Executive brief
SiYuan is a privacy-focused personal knowledge management system. A security flaw in the application's file export feature allows an authorized user to bypass security restrictions and access sensitive files on the host server. This could lead to the exposure of private data, including system configuration files, SSH keys, and the user's entire database of notes.
Technical details
A path traversal vulnerability exists in the `/export/temp/` short-circuit branch of the `serveExport` handler in `kernel/server/serve.go`. While other export paths were previously hardened with `IsSubPath` and `IsSensitivePath` checks, this specific branch joins the raw, percent-decoded request path directly with the temporary directory path without validation. An authenticated attacker can use percent-encoded traversal sequences (e.g., `%2e%2e/`) to escape the intended directory. This allows for the unauthorized retrieval of sensitive files such as `/etc/passwd`, SSH keys, and SiYuan workspace databases (`*.db`). The issue is resolved in version 3.7.2.
Affected products
- siyuan-note SiYuan < 3.7.2
Timeline
- 2026-07-10: advisory: GitHub Security Advisory GHSA-gw25-m53r-qh88 published
- 2026-07-23: disclosed: CVE-2026-65607 published to NVD
- 2026-07-23: patched: Fix confirmed in version 3.7.2