{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 0.0.0-20260407035653-2f416e5253f1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.40.0.0-20260407035653-2f416e5253f1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40318"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-24"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-10T19:32:12Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe endpoint `/api/av/removeUnusedAttributeView` is vulnerable to a **path traversal (CWE-22)** that allows an attacker to delete arbitrary `.json` files on the server.\n\nThe issue arises because user-controlled input (`id`) is directly used in filesystem path construction without validation or restriction.\n\n\u003e Access to this endpoint (e.g., via a Reader-role or publish context) is considered a precondition and not part of the vulnerability. The root cause is unsafe path handling.\n\n---\n\n## Steps To Reproduce\n\n1. Ensure the target instance has the publish service enabled (or any valid access to the endpoint).\n2. Send the following request:\n\n```http\nPOST /api/av/removeUnusedAttributeView HTTP/1.1\nHost: \u003ctarget\u003e\nContent-Type: application/json\n\n{\n  \"id\": \"../../../conf/conf\"\n}\n```\n\n3. Observe that the request is accepted.\n4. The server resolves the path outside the intended directory and deletes the target file.\n\n---\n\n## Impact\n\nAn attacker can delete arbitrary `.json` files within the workspace directory.\n\nThis may lead to:\n\n* Deletion of global configuration files (e.g., `conf/conf.json`)\n* Loss of user data and application state\n* Corruption of workspace metadata\n* Persistent application instability or forced recovery\n\nThis represents a **server-side arbitrary file deletion primitive**, which can have severe impact depending on the targeted files.\n\n---\n\n## Technical Details\n\nThe vulnerable code constructs file paths as follows:\n\n```go\nfilepath.Join(util.DataDir, \"storage\", \"av\", id+\".json\")\n```\n\nBecause `id` is not validated, attackers can inject path traversal sequences such as `../` to escape the intended directory.\n\n### Example payloads\n\n* `../local` \u2192 `data/storage/local.json`\n* `../../storage/outline` \u2192 `data/storage/outline.json`\n* `../../../conf/conf` \u2192 `conf/conf.json`\n\nNo validation or restriction is applied to:\n\n* input format\n* path normalization\n* directory boundaries\n\n---\n\n## Root Cause\n\n* Untrusted user input (`id`) is directly used in filesystem path construction\n* No input validation or sanitization\n* No enforcement that the resolved path stays within the intended directory\n\n---\n\n## Remediation\n\n1. **Validate input strictly**\n\n   * Only allow valid Attribute View IDs\n   * Reject any input containing path traversal sequences\n\n2. **Enforce directory boundaries**\n\n```go\nbase := filepath.Join(util.DataDir, \"storage\", \"av\")\nabsPath := filepath.Join(base, id+\".json\")\n\nif !util.IsSubPath(base, absPath) {\n    return error\n}\n```\n\n3. **Normalize paths before use**\n\n   * Ensure canonical paths cannot escape the base directory\n\n4. **Add additional logical checks**\n\n   * Verify that the target object is valid and allowed to be deleted\n\n---",
  "id": "GHSA-vw86-c94w-v3x4",
  "modified": "2026-04-15T20:40:25Z",
  "published": "2026-04-10T19:32:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vw86-c94w-v3x4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`"
}