Description

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-21T11:17:06.063Z",
  "pubdate": "2026-08-21T11:17:06.063Z",
  "executiveSummary": "SiYuan before v3.7.4 suffers from a path traversal vulnerability residing within the Bazaar install and uninstall endpoints. The flaw stems from a failure to properly validate the packageName parameter, allowing authenticated administrators to supply crafted inputs containing directory traversal sequences. This security deficiency enables attackers with administrative privileges to manipulate file system operations, resulting in arbitrary file writing capabilities during package installation and recursive directory deletion during package uninstallation. The risk implications are severe, as successful exploitation compromises the integrity and availability of the underlying host system by granting unauthorized control over critical file paths outside the intended application directory. Exploitation requires authenticated administrative access to the targeted SiYuan instance, making privilege escalation a prerequisite unless an admin account is already compromised.",
  "technicalDetails": "The vulnerability is localized to the Bazaar install and uninstall endpoints within SiYuan prior to version v3.7.4. The root cause of the issue is inadequate input sanitization and lack of robust validation on the packageName parameter processed by these specific administrative functionalities. When handling package management operations, the application improperly handles user-supplied strings that incorporate directory traversal sequences such as dot-dot-slash patterns.\nThe attack flow proceeds as follows: an authenticated attacker with administrative privileges interacts with the Bazaar installation or uninstallation interfaces. During an installation operation, the attacker crafts a malicious packageName value containing path traversal sequences to force the application engine to write payload contents outside the standard repository directory, thereby facilitating arbitrary file write operations to sensitive system locations. Conversely, during an uninstall operation, supplying a maliciously crafted packageName parameter allows the attacker to induce recursive directory deletion across arbitrary file system paths targeted by the traversal sequences.\nPrivilege and authentication requirements mandate that the actor possesses valid administrative credentials to access the vulnerable Bazaar management endpoints. Network exposure depends on the deployment configuration of the SiYuan instance, typically accessible over HTTP/HTTPS protocols where the administrative interface resides. The post-exploitation impact includes unauthorized modification, overwriting, or destruction of critical system or application files, potentially leading to persistent backdoor placement, application compromise, or denial of service through the systematic deletion of essential directories."
}