CVE-2026-100637
Deferred Deferred - Pending Action

SiYuan Path Traversal in checkoutRepo Endpoint

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON files in pre-existing kernel-writable directories outside workspace boundaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100637
EUVD
EUVD-2026-87731

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions before v3.8.4 have a path traversal vulnerability in the checkoutRepo endpoint. Authenticated administrators can exploit the sessionID parameter to write JSON files outside the workspace by including directory traversal sequences like ../../../../. This allows overwriting arbitrary JSON files in pre-existing kernel-writable directories beyond workspace boundaries.

Detection Guidance

Check SiYuan versions before 3.8.4 for the vulnerable endpoint /api/repo/checkoutRepo. Monitor POST requests with sessionID parameters containing directory traversal sequences like ../../../../. Use network logs to detect unauthorized JSON file writes outside workspace directories.

Impact Analysis

An attacker with admin access could overwrite critical JSON files outside the workspace, potentially corrupting configuration or state files in other workspaces or shared directories. This may lead to data loss, system instability, or unauthorized modifications to application behavior.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating integrity and confidentiality requirements in GDPR and HIPAA. If exploited, it may result in non-compliance due to potential data breaches or tampering with sensitive information.

Mitigation Strategies

Upgrade SiYuan to version 3.8.4 or later immediately. Restrict admin access to the checkoutRepo endpoint. Validate sessionID inputs to prevent path traversal. Audit file system permissions for kernel-writable directories outside workspaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100637. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart