Description

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, enabling stored XSS or workspace defacement.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-26T14:16:45.160Z",
  "pubdate": "2026-09-26T14:16:45.160Z",
  "executiveSummary": "SiYuan versions prior to v3.8.4 are susceptible to a critical path traversal vulnerability within the exportBrowserHTML endpoint. This security flaw allows an authenticated administrator to perform unauthorized file system operations by manipulating the folder parameter with directory traversal sequences.\nBy escaping the designated export directory, an attacker can overwrite the index.html file located in any kernel-writable directory on the host system. This vulnerability facilitates Stored Cross-Site Scripting (XSS) attacks or full workspace defacement, effectively undermining the integrity of the application's hosting environment.\nThe vulnerability is restricted to authenticated administrative users, meaning the primary threat vector involves compromised administrative accounts or malicious insiders. Successful exploitation permits the arbitrary injection of HTML content, which can be leveraged to execute malicious scripts in the context of users accessing the affected web interface. Given the potential for persistent XSS and system-wide modifications to the application's landing page, the risk to the confidentiality and integrity of the SiYuan workspace is considered significant. Users are strongly advised to upgrade to version v3.8.4 or higher to remediate the underlying flaw.",
  "technicalDetails": "The vulnerability exists within the exportBrowserHTML endpoint, which fails to adequately sanitize the folder parameter before utilizing it in file system operations. The root cause is improper neutralization of special elements used in pathnames, specifically directory traversal sequences such as '../'.\nDuring the exploitation process, an authenticated administrator sends a crafted request to the exportBrowserHTML endpoint. By supplying a path traversal payload within the folder parameter, the attacker forces the application to resolve file paths outside of the intended export directory. Because the SiYuan kernel operates with specific permissions, it attempts to write the resulting HTML export content to the directory specified by the manipulated path.\nIf the attacker targets a location containing an index.html file that is writable by the SiYuan process, the application will overwrite the existing file with the provided HTML payload. The attack flow is as follows: 1) An authenticated attacker initiates an export operation via the exportBrowserHTML endpoint. 2) The attacker intercepts or crafts the request to inject path traversal sequences (e.g., ../../../) into the folder parameter. 3) The backend server resolves this path to a sensitive directory on the host file system. 4) The application writes the generated HTML file to the attacker-defined destination. 5) When a user subsequently accesses the overwritten index.html, the injected malicious HTML or JavaScript is rendered, leading to Stored XSS or defacement.\nThis vulnerability is particularly dangerous because it grants the ability to modify core system files if the service is running with elevated privileges or if the targeted directory is within the application's defined writable scope. The impact includes the potential for session hijacking, credential theft, or unauthorized redirection of users accessing the compromised instance. As the payload is stored persistently in the file system, the malicious content remains active until manually corrected or overwritten, providing a long-term mechanism for client-side attacks against any user viewing the defaced page."
}