{"id":"CVE-2026-65607","title":"SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go)","summary":"SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22"],"vendor":"siyuan-note","product":"siyuan","affected":["siyuan < 3.7.2"],"patched":["github.com/siyuan-note/siyuan/kernel 0.0.0-20260510110132-b763d787d1f2"],"published":"2026-07-23","updated":"2026-10-08","sourceUpdated":"2026-10-08T16:17:29.540","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65607","references":[{"url":"https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7","label":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gw25-m53r-qh88","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-export-temp","label":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/commit/b763d787d1f2b862c577049e4ee147c5857fe413"},{"url":"https://github.com/siyuan-note/siyuan"}],"tags":["nvd","cve.org","osv","go"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-27T16:13:34.297770Z"},"epss":0.00586,"epssPercentile":0.47817,"aliases":["GHSA-gw25-m53r-qh88"],"ecosystem":"go","ingestedAt":"2026-09-03T19:32:13.601Z","slug":"CVE-2026-65607","body":"## Overview\n\nSiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-65607)\n\nAffected packages:\n\n- `github.com/siyuan-note/siyuan/kernel < 0.0.0-20260510110132-b763d787d1f2`\n\nPatched in:\n\n- `github.com/siyuan-note/siyuan/kernel 0.0.0-20260510110132-b763d787d1f2`\n\nSource: https://osv.dev/vulnerability/GHSA-gw25-m53r-qh88","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}