CVE-2026-109309
Deferred Deferred - Pending Action

SiYuan Kernel Plugin Absolute Path Traversal

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109309
EUVD
EUVD-2026-97611

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan-note siyuan 3.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan v3.7.0 before v3.8.6 has an absolute path traversal vulnerability in its kernel's private plugin HTTP server. The server passes a plugin handler's ResponseFile.Path directly to gin's Context.File without validation. This allows attackers who supply a malicious kernel plugin to read any file accessible to the SiYuan process by specifying an absolute path, including sensitive files like the API token and conf.json.

Detection Guidance

To detect this vulnerability, check if your SiYuan version is between 3.7.0 and 3.8.5. Run 'siyuan --version' to verify. Inspect plugin responses for absolute file paths in HTTP responses. Monitor for unauthorized file access attempts in logs.

Impact Analysis

This vulnerability could allow an attacker to read sensitive files on your system if you are running a vulnerable version of SiYuan. This includes configuration files containing API tokens or other credentials, potentially leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files, including configuration files and API tokens, which may contain personal or confidential data. Such exposure risks violating GDPR's data protection principles and HIPAA's safeguards for protected health information if applicable data is accessed.

Mitigation Strategies

Upgrade SiYuan to version 3.8.6 or later to address the absolute path traversal vulnerability in the kernel's private plugin HTTP server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109309. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart