Executive brief
SiYuan is a note-taking application with file export functionality. An authenticated user can bypass the security safeguards intended to prevent reading sensitive files (like workspace databases, SSH keys, or system files) by crafting a path traversal attack through the `/export/temp/` endpoint. This allows an attacker with valid credentials to read arbitrary files on the server, circumventing the hardened protections added to the main export handler.
Technical details
The vulnerability is a path traversal (CWE-22) in SiYuan's `kernel/server/serve.go` `serveExport()` function. A short-circuit branch that handles `/export/temp/` requests calls `filepath.Join(util.TempDir, c.Request.URL.Path)` on the raw, percent-decoded request path without applying the `IsSubPath` or `IsSensitivePath` checks that protect the main export branch. Since the HTTP handler decodes `%2e%2e` to `..`, and `filepath.Join` collapses directory traversal sequences, an authenticated attacker can construct paths like `/export/temp/%2e%2e/%2e%2e/.../etc/passwd` to read files outside `TempDir`. The vulnerability requires valid SiYuan authentication but defeats the stated goal of denying sensitive-file export even to authorized users. Patches should apply the same guards to the `/export/temp/` branch or merge both branches into a single protected function.
Affected products
- siyuan-note siyuan from commit bb481e1 through latest master; patched in 0.0.0-20260510110132-b763d787d1f2
Timeline
- 2026-09-03: disclosed: GHSA-gw25-m53r-qh88 published to GitHub Advisory Database
- 2026-05-10: patched: Patch committed as b763d787d1f2b862c577049e4ee147c5857fe413