Vulnerability-Lookup

CVE-2026-30869 (GCVE-0-2026-30869)

Vulnerability from cvelistv5 – Published: 2026-03-09 22:28 – Updated: 2026-03-10 14:18

Title

SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

Summary

SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10.

Severity ?

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

https://github.com/siyuan-note/siyuan/security/ad…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	siyuan-note	siyuan	Affected: < 3.5.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30869",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T14:18:43.579827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T14:18:46.445Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "siyuan",
          "vendor": "siyuan-note",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.5.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double\u2011encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-09T22:28:06.949Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w"
        }
      ],
      "source": {
        "advisory": "GHSA-2h2p-mvfx-868w",
        "discovery": "UNKNOWN"
      },
      "title": "SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30869",
    "datePublished": "2026-03-09T22:28:06.949Z",
    "dateReserved": "2026-03-06T00:04:56.697Z",
    "dateUpdated": "2026-03-10T14:18:46.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-30869\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-10T17:40:14.380\",\"lastModified\":\"2026-03-13T15:33:01.727\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double\u2011encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10.\"},{\"lang\":\"es\",\"value\":\"SiYuan es un sistema de gesti\u00f3n de conocimiento personal. Antes de la 3.5.10, una vulnerabilidad de salto de ruta en el endpoint /export permite a un atacante leer archivos arbitrarios del sistema de archivos del servidor. Al explotar secuencias de salto doblemente codificadas, un atacante puede acceder a archivos sensibles como conf/conf.json, que contiene secretos, incluyendo el token de la API, la clave de firma de cookies y el c\u00f3digo de autenticaci\u00f3n de acceso al espacio de trabajo. La filtraci\u00f3n de estos secretos puede habilitar el acceso administrativo a la API del kernel de SiYuan, y en ciertos escenarios de despliegue podr\u00eda potencialmente encadenarse en ejecuci\u00f3n remota de c\u00f3digo (RCE). Esta vulnerabilidad est\u00e1 corregida en la 3.5.10.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.5.10\",\"matchCriteriaId\":\"0E7B145F-4786-4534-B4D6-A947F4CD06FE\"}]}]}],\"references\":[{\"url\":\"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-30869\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-10T14:18:43.579827Z\"}}}], \"references\": [{\"url\": \"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-10T14:18:38.916Z\"}}], \"cna\": {\"title\": \"SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage\", \"source\": {\"advisory\": \"GHSA-2h2p-mvfx-868w\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"siyuan-note\", \"product\": \"siyuan\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.5.10\"}]}], \"references\": [{\"url\": \"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w\", \"name\": \"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double\\u2011encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-09T22:28:06.949Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-30869\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-10T14:18:46.445Z\", \"dateReserved\": \"2026-03-06T00:04:56.697Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-09T22:28:06.949Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-2H2P-MVFX-868W

Vulnerability from github – Published: 2026-03-07 02:19 – Updated: 2026-03-10 18:43

Summary

SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

Details

Summary

A path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code.

Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE).

Details

File: serve.go, session.go Lines: serve.go 303, 315, 320, 340, 955-957; session.go 292-295

Vulnerable Code:

// session.go
if localhost {
    if strings.HasPrefix(c.Request.RequestURI, "/assets/") || strings.HasPrefix(c.Request.RequestURI, "/export/") {
        c.Set(RoleContextKey, RoleAdministrator)
        c.Next()
        return
    }
}

// serve.go
filePath := strings.TrimPrefix(c.Request.URL.Path, "/export/")
decodedPath, err := url.PathUnescape(filePath)
fullPath := filepath.Join(exportBaseDir, decodedPath)
c.File(fullPath)

// CORS
c.Header("Access-Control-Allow-Origin", "*")

Points of Vulnerability:

/export/* trusts url.PathUnescape output and joins it without enforcing fullPath to stay under exportBaseDir.
Double-encoded traversal (%252e%252e) bypasses ServeFile dot-dot URL rejection but is decoded by app logic into ...
CheckAuth grants admin for localhost requests to /export/* when access auth code is set.
Global CORS Access-Control-Allow-Origin: * allows hostile web pages to read localhost responses.

PoC

Reproduction Steps:

Send a GET request to /export/%252e%252e/%252e%252e/conf/conf.json or export/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd
If HTTP 200 is returned, inspect the response body for sensitive fields:

api.token
cookieKey
accessAuthCode

/etc/passwd

(Optional) If api.token is present, test admin API access:

POST /api/system/getNetwork
Header: Authorization: Token <leaked token>

Confirm that the response indicates administrative privileges. All steps can be performed with read-only HTTP requests; no Docker or local modifications are needed.

Impact

This vulnerability can lead to serious compromise of a SiYuan instance, including:

Arbitrary File Disclosure - Attackers can read files anywhere on the server filesystem, including system files such as /etc/passwd.

Exposure of Sensitive Secrets - Configuration files such as conf/conf.json contain sensitive information including: - API tokens - cookie signing keys - workspace authentication codes

Administrative API Access - Leaked tokens can allow attackers to interact with privileged SiYuan kernel APIs.

Cross‑Origin Localhost Data Exfiltration - Because the server sets Access-Control-Allow-Origin: *, a malicious website can exploit the vulnerability to read files from a victim's local SiYuan instance running on 127.0.0.1.

Potential Remote Code Execution (RCE) - Disclosure of authentication secrets and internal configuration may enable attackers to chain this vulnerability with other application features or APIs to achieve remote code execution or full system compromise.

Severity ?

9.3 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.5.9"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30869"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-22",
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-07T02:19:45Z",
    "nvd_published_at": "2026-03-10T17:40:14Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nA path traversal vulnerability in the `/export` endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double\u2011encoded traversal sequences, an attacker can access sensitive files such as `conf/conf.json`, which contains secrets including the API token, cookie signing key, and workspace access authentication code.\n\nLeaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into `remote code execution (RCE)`.\n\n### Details\nFile: [serve.go](app://-/index.html?hostId=local#), [session.go](app://-/index.html?hostId=local#)\nLines: serve.go 303, 315, 320, 340, 955-957; session.go 292-295\n\nVulnerable Code:\n```\n// session.go\nif localhost {\n    if strings.HasPrefix(c.Request.RequestURI, \"/assets/\") || strings.HasPrefix(c.Request.RequestURI, \"/export/\") {\n        c.Set(RoleContextKey, RoleAdministrator)\n        c.Next()\n        return\n    }\n}\n\n// serve.go\nfilePath := strings.TrimPrefix(c.Request.URL.Path, \"/export/\")\ndecodedPath, err := url.PathUnescape(filePath)\nfullPath := filepath.Join(exportBaseDir, decodedPath)\nc.File(fullPath)\n\n// CORS\nc.Header(\"Access-Control-Allow-Origin\", \"*\")\n\n```\nPoints of Vulnerability:\n\n- `/export/*` trusts url.PathUnescape output and joins it without enforcing fullPath to stay under exportBaseDir.\n- Double-encoded traversal (`%252e%252e`) bypasses `ServeFile` dot-dot URL rejection but is decoded by app logic into ...\n- `CheckAuth` grants admin for localhost requests to `/export/*` when access auth code is set.\n- Global CORS `Access-Control-Allow-Origin: *` allows hostile web pages to read localhost responses.\n\n### PoC\n\nReproduction Steps:\n\n1. Send a GET request to `/export/%252e%252e/%252e%252e/conf/conf.json` or `export/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd`\n\n2. If HTTP 200 is returned, inspect the response body for sensitive fields:\n```\napi.token\ncookieKey\naccessAuthCode\n```\nor\n```\n/etc/passwd\n```\n\n3. (Optional) If api.token is present, test admin API access:\n```\nPOST /api/system/getNetwork\nHeader: Authorization: Token \u003cleaked token\u003e\n```\n\n4. Confirm that the response indicates administrative privileges.\nAll steps can be performed with read-only HTTP requests; no Docker or local modifications are needed.\n### Impact\n\nThis vulnerability can lead to serious compromise of a SiYuan instance, including:\n\n**Arbitrary File Disclosure**\n- Attackers can read files anywhere on the server filesystem, including system files such as /etc/passwd.\n\n**Exposure of Sensitive Secrets**\n- Configuration files such as conf/conf.json contain sensitive information including:\n- API tokens\n- cookie signing keys\n- workspace authentication codes\n\n**Administrative API Access**\n- Leaked tokens can allow attackers to interact with privileged SiYuan kernel APIs.\n\n**Cross\u2011Origin Localhost Data Exfiltration**\n- Because the server sets `Access-Control-Allow-Origin: *`, a malicious website can exploit the vulnerability to read files from a victim\u0027s local SiYuan instance running on 127.0.0.1.\n\n**Potential Remote Code Execution (RCE)**\n- Disclosure of authentication secrets and internal configuration may enable attackers to chain this vulnerability with other application features or APIs to achieve remote code execution or full system compromise.",
  "id": "GHSA-2h2p-mvfx-868w",
  "modified": "2026-03-10T18:43:18Z",
  "published": "2026-03-07T02:19:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30869"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage"
}

FKIE_CVE-2026-30869

Vulnerability from fkie_nvd - Published: 2026-03-10 17:40 - Updated: 2026-03-13 15:33

Severity ?

9.3 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w	Exploit, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	b3log	siyuan	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E7B145F-4786-4534-B4D6-A947F4CD06FE",
              "versionEndExcluding": "3.5.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double\u2011encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10."
    },
    {
      "lang": "es",
      "value": "SiYuan es un sistema de gesti\u00f3n de conocimiento personal. Antes de la 3.5.10, una vulnerabilidad de salto de ruta en el endpoint /export permite a un atacante leer archivos arbitrarios del sistema de archivos del servidor. Al explotar secuencias de salto doblemente codificadas, un atacante puede acceder a archivos sensibles como conf/conf.json, que contiene secretos, incluyendo el token de la API, la clave de firma de cookies y el c\u00f3digo de autenticaci\u00f3n de acceso al espacio de trabajo. La filtraci\u00f3n de estos secretos puede habilitar el acceso administrativo a la API del kernel de SiYuan, y en ciertos escenarios de despliegue podr\u00eda potencialmente encadenarse en ejecuci\u00f3n remota de c\u00f3digo (RCE). Esta vulnerabilidad est\u00e1 corregida en la 3.5.10."
    }
  ],
  "id": "CVE-2026-30869",
  "lastModified": "2026-03-13T15:33:01.727",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-10T17:40:14.380",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-30869 (GCVE-0-2026-30869)

GHSA-2H2P-MVFX-868W

Summary

Details

PoC

Impact

FKIE_CVE-2026-30869

Tags

Sightings

Nomenclature