Executive brief
SiYuan is a note-taking and knowledge management application that supports a publish mode for sharing content. Static file routes in the server bypass the access control rules enforced on the REST API, allowing unauthorized readers to access restricted templates, snippets, export artifacts, and plugin/widget directories. This exposes sensitive user-authored documents and configuration that should only be available to administrators.
Technical details
The vulnerability is a missing authorization check (CWE-862) in static file routes within kernel/server/serve.go. Four route groups are affected: /templates/, /snippets/, /widgets/+/plugins/+/emojis/, and /export/. All are registered with CheckAuth guard only, lacking the publish-access scoping and sensitive-path checks (/IsSensitivePath) that parallel REST API endpoints enforce. Most notably, /templates/ directly contradicts existing controls: the REST file API explicitly blocks data/templates/ to non-administrators via refuseToAccess (kernel/api/file.go:551-553), but the static route serves it to any RoleReader. Similarly, /export/ allows readers to retrieve exported content (PDF/HTML/DOCX/CSV) of arbitrary documents by exploiting predictable naming (e.g., export/csv/<doc-name>/<doc-name>.csv). The /assets/* route correctly implements CheckAbsPathAccessableByPublishAccess; /export/ carries DEK and traversal guards but omits the publish-access gate. Attack vector is network with no authentication required in anonymous mode. The patch (commit 34be6c0) applies equivalent authorization checks to static routes as their REST counterparts.
Affected products
- siyuan-note siyuan < 0.0.0-20260725122641-34be6c0bb073
Timeline
- 2026-07-25: disclosed: Vulnerability published by GitHub Advisory Database
- 2026-09-04: advisory: GitHub Security Advisory GHSA-fgmr-7w36-9qfq published
- 2026-09-04: patched: Fix released as commit 34be6c0bb0739d5b8e99ecc0cbfb474abb16230d