CVE-2026-59832

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticated request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to read workspace secrets and the document database. This issue is fixed in versions 3.7.1.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/siyuan-note/siyuan/commit/68cc0f537dfa4502496dfa794e71835421c25c09
https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-275h-v5h9-vr82

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) SiYuan es un sistema de gestión de conocimiento personal de código abierto. Antes de la versión 3.7.1, el gestor de ruta /snippets/filepath serveSnippets en kernel/server/serve.go une una ruta de solicitud decodificada una sola vez con el directorio de snippets sin contención de subrutas ni comprobaciones de rutas sensibles, lo que permite que una solicitud autenticada como /snippets/%2e%2e/%2e%2e/conf/conf.json lea secretos del espacio de trabajo y la base de datos de documentos. Este problema se ha solucionado en la versión 3.7.1.

Information

Published : 2026-07-09 23:17

Updated : 2026-10-25 15:10

NVD link : CVE-2026-59832

Mitre link : CVE-2026-59832

CVE.ORG link : CVE-2026-59832

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-23

Relative Path Traversal

{"id": "CVE-2026-59832", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59832", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T14:41:47.607410Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "< 3.7.1"}]}]}], "published": "2026-07-09T23:17:05.627", "references": [{"url": "https://github.com/siyuan-note/siyuan/commit/68cc0f537dfa4502496dfa794e71835421c25c09", "source": "security-advisories@github.com"}, {"url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-275h-v5h9-vr82", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticated request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to read workspace secrets and the document database. This issue is fixed in versions 3.7.1."}, {"lang": "es", "value": "SiYuan es un sistema de gesti\u00f3n de conocimiento personal de c\u00f3digo abierto. Antes de la versi\u00f3n 3.7.1, el gestor de ruta /snippets/filepath serveSnippets en kernel/server/serve.go une una ruta de solicitud decodificada una sola vez con el directorio de snippets sin contenci\u00f3n de subrutas ni comprobaciones de rutas sensibles, lo que permite que una solicitud autenticada como /snippets/%2e%2e/%2e%2e/conf/conf.json lea secretos del espacio de trabajo y la base de datos de documentos. Este problema se ha solucionado en la versi\u00f3n 3.7.1."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "security-advisories@github.com"}