CVE-2026-65607
Received Received - Intake

Path Traversal in SiYuan Before v3.7.2

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65607
EUVD
EUVD-2026-48243

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.7.2 has a path traversal flaw in the /export/temp/ endpoint. The vulnerability allows authenticated attackers to bypass security checks by using percent-encoded sequences like %2e%2e (decoded as '..') to access files outside the intended temporary directory. This bypasses protections like IsSubPath and IsSensitivePath checks, enabling access to sensitive files such as /etc/passwd, SSH keys, or SiYuan workspace files.

Detection Guidance

To detect this vulnerability, monitor for unauthorized access attempts to sensitive files via the /export/temp/ endpoint. Check SiYuan logs for requests containing percent-encoded traversal sequences like %2e%2e or unusual file paths. Use network monitoring tools to inspect HTTP requests targeting /export/temp/ with suspicious query parameters.

Impact Analysis

An attacker could read sensitive files on your system, including system files like /etc/passwd, SSH keys, or SiYuan database and log files. This could lead to data exposure, unauthorized access to credentials, or compromise of SiYuan's internal data. The impact is limited to authenticated users but allows full file system access outside the intended directory.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Exposure of personal data, credentials, or system files may result in non-compliance, potential fines, and reputational damage due to data breaches.

Mitigation Strategies

Immediately update SiYuan to version 3.7.2 or later to apply the security fix. If updating is not possible, restrict access to the /export/temp/ endpoint or implement additional path validation checks to prevent traversal sequences. Review system logs for signs of exploitation and remove any unauthorized file access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart