SiYuan Path Traversal Vulnerability Before v3.7.4

Executive Summary

CVE-2026-73605 is a path traversal vulnerability in SiYuan versions before v3.7.4. The getUniqueFilename endpoint accepts unvalidated client-supplied paths and checks filesystem existence without validation or confinement. Attackers can probe arbitrary absolute paths to determine if files or directories exist on the host, enabling filesystem reconnaissance.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, send HTTP requests to the getUniqueFilename endpoint with arbitrary absolute paths and observe the responses. If the server distinguishes between existing and non-existing paths, it may indicate the vulnerability. Example using curl: curl -X POST -H 'Content-Type: application/json' -d '{"path":"/etc/passwd"}' http://target/siyuan/getUniqueFilename. Compare responses for different paths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to map your filesystem layout, detect installed software, identify user directories, and probe workspace structure. It enables information disclosure without requiring privileges or user interaction, posing a risk for reconnaissance and potential further attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version v3.7.4 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to the getUniqueFilename endpoint by implementing path validation to confine paths to the workspace or adding authorization checks like admin role verification.

Useful 0 Not Useful 0