Executive brief
SiYuan is a popular open-source personal knowledge management application. Four API endpoints that serve attribute-view (database) data fail to properly validate user-supplied file identifiers, allowing an attacker with read-level publish access—or no authentication if auth is disabled—to escape the intended storage directory and read JSON configuration files from elsewhere in the user's workspace. This enables unauthorized disclosure of data from other notebooks or scopes that the attacker should not be able to access.
Technical details
The vulnerability exists in four POST endpoints (`/api/av/renderAttributeView`, `/api/av/getAttributeViewKeysByID`, `/api/av/getAttributeViewKeys`, `/api/av/getCurrentAttrViewImages`) that construct file paths using the `filepath.Join` function with a user-controlled `id` or `avID` parameter. The application's only identifier validation—`ast.IsNodeIDPattern(avID)`—is conditionally placed on a create-branch code path and is skipped when reading existing files. Because `filepath.Join` cleans but does not reject `..` path segments, an attacker can craft an identifier like `../../other/notebook/config` to read files outside `DataDir/storage/av/`. All endpoints require only `CheckAuth` (satisfied by a `RoleReader` publish token or bypassed entirely when `Publish.Auth.Enable` is false), and the breach is limited to `.json` files due to the forced `.json` suffix, but enables reliable disclosure of attribute-view schema data and existence oracles for workspace paths.
Affected products
- SiYuan SiYuan before 0.0.0-20260720151813-0f5a0e7c67b0
Timeline
- 2026-09-03: disclosed: Vulnerability published via GitHub Advisory Database
- 2026-07-20: patched: Patch version 0.0.0-20260720151813-0f5a0e7c67b0 released