SiYuan Path Traversal Vulnerability Exposes Sensitive Files

Executive Summary

SiYuan 3.8.0 has a path traversal vulnerability in the RenderTemplate function that allows authenticated attackers to read sensitive files within the workspace. The /api/template/render endpoint restricts paths to the workspace directory but lacks a blocklist for sensitive files like conf/conf.json, which contains API tokens and cookie signing keys. This flaw is fixed in version 3.8.1.

Useful 0 Not Useful 0

Detection Guidance

Check SiYuan logs for unusual requests to /api/template/render with suspicious paths. Inspect network traffic for POST requests targeting this endpoint with file paths outside the templates directory. Verify if conf/conf.json or other sensitive files were accessed.

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker could exploit this to read sensitive files, including configuration files with API tokens and cookie signing keys. This could lead to unauthorized access to user data, account takeover, or further compromise of the SiYuan instance if those secrets are used elsewhere.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Exposure of API tokens and signing keys may also indicate inadequate security controls, potentially resulting in compliance violations and penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.8.1 or later immediately. Review workspace file access logs for signs of exploitation. Restrict API access to trusted users and monitor for unauthorized file reads.

Useful 0 Not Useful 0