CVE-2026-65607: SiYuan before v3.7.2 Path Traversal via /export/temp/
SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/), and SiYuan workspace .db and .log files, bypassing the sensitive-file protection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.2 - Compensating control
Restrict access to the SiYuan export/temp endpoint ("/export/temp/") to trusted users/IPs until all instances are upgraded to v3.7.2, to reduce exposure to the authenticated path traversal short-circuit branch in kernel/server/serve.go.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65607?
The severity of CVE-2026-65607 is medium with a score of 6.5.
How do I fix CVE-2026-65607?
To fix CVE-2026-65607, upgrade SiYuan to version 3.7.2 or later.
What is the nature of the vulnerability in CVE-2026-65607?
CVE-2026-65607 is a path traversal vulnerability in the /export/temp/ short-circuit branch.
Which software is affected by CVE-2026-65607?
CVE-2026-65607 affects SiYuan versions before 3.7.2.
What impact does CVE-2026-65607 have on data confidentiality?
CVE-2026-65607 may lead to unauthorized access to sensitive files due to its path traversal exploit.