SiYuan Elevator Privilege Escalation via Path Traversal

Executive Summary

CVE-2026-74801 is a local privilege escalation vulnerability in SiYuan, a note-taking app for Windows. It occurs when SiYuan fails to properly escape workspace directory paths when passing them to an elevated helper process called elevator.exe. Attackers can create a malicious workspace directory with command metacharacters in its name. When SiYuan tries to add a Windows Defender exclusion for the workspace, it launches elevator.exe with admin rights via UAC. The helper then executes commands without proper validation, allowing arbitrary code execution with administrator privileges after the user approves the UAC prompt.

Useful 0 Not Useful 0

Detection Guidance

Check SiYuan version with 'SiYuan --version' or inspect installed files. Look for workspace directories with suspicious names containing command metacharacters like &, |, or ;. Monitor for unexpected UAC prompts from elevator.exe or SiYuan processes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with local access to escalate privileges from a standard user to administrator. An attacker could create a malicious workspace directory and trick a user into triggering the Defender exclusion flow. After the user approves the UAC prompt, arbitrary commands would execute with full system privileges. This could lead to complete system compromise, data theft, malware installation, or further lateral movement within a network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If exploited, it may result in data breaches that require regulatory reporting under these standards. Organizations using affected SiYuan versions may face compliance violations due to inadequate security controls against privilege escalation attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later immediately. Avoid creating workspace directories with special characters. Disable automatic Microsoft Defender exclusion prompts in SiYuan settings. Temporarily revoke UAC elevation rights for SiYuan if possible.

Useful 0 Not Useful 0