SiYuan Path Traversal in setNotebookIcon Endpoint

Executive Summary

CVE-2026-100638 is a path traversal vulnerability in SiYuan note-taking app versions before v3.8.4. It affects the setNotebookIcon endpoint where authenticated administrators can use directory traversal sequences in the notebook parameter to escape the workspace directory and write files like conf.json outside the intended boundaries.

Useful 0 Not Useful 0

Detection Guidance

Check SiYuan application logs for suspicious file write operations or directory creation outside the workspace. Monitor for unauthorized conf.json file modifications in system directories like /tmp or web roots. Review network traffic for POST requests to the setNotebookIcon endpoint with unusual notebook parameter values containing path traversal sequences.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to create arbitrary directories and write files outside the workspace. This could lead to unauthorized file manipulation, system compromise, or further exploitation if conf.json files are written to sensitive locations like /tmp or web roots.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.8.4 or later immediately. Restrict administrative access to the application. Review and remove any unauthorized conf.json files written outside the workspace. Implement input validation for the notebook parameter to prevent path traversal sequences.

Useful 0 Not Useful 0