Description

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON files in pre-existing kernel-writable directories outside workspace boundaries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-26T14:16:45.320Z",
  "pubdate": "2026-09-26T14:16:45.320Z",
  "executiveSummary": "SiYuan versions prior to v3.8.4 are susceptible to a path traversal vulnerability located within the 'checkoutRepo' endpoint. This flaw allows an authenticated administrator to perform arbitrary write operations on JSON files residing outside the designated application workspace.\nThe vulnerability arises from insufficient sanitization of the 'sessionID' parameter, which enables directory traversal sequences (e.g., '../') to bypass filesystem access restrictions. By manipulating this parameter, a malicious actor with administrative privileges can overwrite configuration or data files within any directory where the SiYuan kernel possesses write permissions.\nThe impact of this vulnerability is significant, as it facilitates unauthorized modification of the application state or critical system files. Successful exploitation compromises the integrity of the host environment, potentially leading to privilege escalation, arbitrary code execution, or persistent backdooring of the application. This vulnerability is strictly limited to authenticated administrators, necessitating prior compromise of an administrative session to execute the attack.",
  "technicalDetails": "The vulnerability resides in the 'checkoutRepo' endpoint of the SiYuan kernel, specifically within the logic handling the 'sessionID' parameter. During the request processing flow, the application fails to adequately validate or normalize the provided 'sessionID' string before utilizing it as a component of a file path for JSON write operations.\nThe root cause is an improper neutralization of special elements in a file path (CWE-22), where the application treats user-supplied input as a trusted path segment. Because the kernel component operates with filesystem-level permissions, the lack of a jailed or restricted directory access control mechanism allows the application to resolve traversal sequences such as '../'.\nTo exploit this, an attacker must first authenticate as an administrator. The attack flow begins by crafting a malicious HTTP request directed at the 'checkoutRepo' endpoint. The attacker injects directory traversal characters (e.g., ../../../etc/config.json) into the 'sessionID' parameter. When the SiYuan kernel processes this request, it fails to perform a canonicalization check on the resulting path, allowing the process to escape the intended workspace directory.\nOnce the traversal is successful, the application directs the JSON write operation to the target file specified by the attacker. Since the kernel has write access to multiple directories beyond the workspace, the attacker can overwrite sensitive JSON-based configuration files or local data stores. If an attacker overwrites critical system files that are subsequently parsed by the SiYuan kernel or the underlying operating system, they may achieve secondary effects such as session hijacking, configuration manipulation, or potential code execution depending on the content of the JSON files and how the application interprets them upon restart or service initialization.\nThis vulnerability persists across all versions of SiYuan before v3.8.4. It requires a network-accessible instance with an active administrative session, making it a critical threat to multi-user or externally exposed deployments. Post-exploitation, the attacker maintains persistence or control over the application's configuration by leveraging the ability to modify the filesystem state arbitrarily."
}