Executive brief
SiYuan is a personal knowledge management and note-taking application. The vulnerability allows anonymous users to probe whether arbitrary files and directories exist on the server's filesystem, enabling attackers to map the system layout, discover installed software, and identify backup or sync directories—without requiring any credentials or authentication.
Technical details
The vulnerability is a path traversal / information disclosure flaw in the /api/file/getUniqueFilename endpoint. The endpoint accepts a user-supplied path from the request body and passes it directly to a filesystem existence check without validation, confinement, or authorization. The response distinguishes existing paths (appended with a "(1)" suffix) from non-existent ones, creating an existence oracle. Attack preconditions are minimal: the attacker must be able to reach the endpoint (network reachable) and requires no credentials in publish mode with Publish.Auth.Enable set to false. An attacker can systematically probe arbitrary absolute filesystem paths—files and directories alike—to enumerate the filesystem layout. The fix involves confining paths via GetAbsPathInWorkspace (as the adjacent getFile route does) or adding administrative role and read-only checks, and patches are available in SiYuan v3.7.4 and later.
Affected products
- SiYuan SiYuan before v3.7.4
Timeline
- 2026-07-29: disclosed
- 2026-08-13: advisory
- 2026-08-13: patched: v3.7.4 released