SiYuan Path Traversal in Export Function Leading to Stored XSS

Executive Summary

This vulnerability is a path traversal flaw in SiYuan versions before v3.8.4. It exists in the exportBrowserHTML endpoint and allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can use directory traversal sequences in the folder parameter to escape the export directory and overwrite index.html in any kernel-writable location, potentially enabling stored XSS or workspace defacement.

Useful 0 Not Useful 0

Detection Guidance

Check SiYuan versions before 3.8.4 for the exportBrowserHTML endpoint. Look for suspicious file writes outside workspace directories, especially index.html. Monitor logs for directory traversal patterns like ../../../../ in folder parameters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to stored cross-site scripting (XSS) attacks if the overwritten index.html is served. It may also allow workspace defacement by replacing the index.html file with malicious content. The impact is limited to kernel-writable locations, meaning only directories accessible by the SiYuan kernel can be affected.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.8.4 or later. Restrict write permissions to kernel-writable locations. Implement input validation to block path traversal sequences in the folder parameter. Disable the exportBrowserHTML endpoint if not needed.

Useful 0 Not Useful 0