CVE-2026-109309GHSA-phmw-4rgv-r4xv
SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
siyuan-note siyuan
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.8.6siyuanCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.
Text from CVE List
Affected versions 2
- siyuanaffected: 3.7.0 before 3.8.6CVE List
- siyuanunaffected: 3.8.6CVE List
References 3
- github.com/siyuan-note/siyuan/commit/c6494375ea40ee973f430f0e85d50f1862a30d81Fixvia CVE List
- github.com/siyuan-note/siyuan/security/advisories/GHSA-phmw-4rgv-r4xvAdvisoryvia CVE List
- vulncheck.com/advisories/siyuan-3.7.0-before-3.8.6-arbitrary-file-read-via-plugin-responsefile-pathAdvisoryvia CVE List