Description

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-30T15:16:45.753Z",
  "pubdate": "2026-08-30T15:16:45.753Z",
  "executiveSummary": "An improper path validation vulnerability exists in SiYuan versions prior to 3.8.1, specifically affecting the /history/*path and /repo/diff/*path endpoints within the kernel server.\nThis vulnerability is classified as a Path Traversal issue where the application fails to enforce the IsForbiddenAbsPath security guard, which was previously implemented to restrict access to sensitive system files.\nThe vulnerability allows an authenticated administrator to bypass intended directory restrictions and retrieve sensitive files from the underlying server filesystem, including configuration files containing plaintext credentials.\nWhile the endpoints require administrative authentication, the flaw demonstrates a failure in secure input handling and broken access control within the server-side kernel logic.\nThe impact is significant as it facilitates the exfiltration of sensitive system data, such as publish-mode passwords stored in data/.siyuan/publishAccess.json, potentially leading to full compromise of the application's external integration security.",
  "technicalDetails": "The vulnerability resides in the kernel/server/serve.go file, which fails to apply the IsForbiddenAbsPath security guard—an established protective mechanism designed to block unauthorized access to sensitive filesystem locations—to the /history/*path and /repo/diff/*path routes.\nRoot cause analysis reveals a lack of consistent security middleware application across all kernel endpoints. While these specific routes perform administrative authentication checks, they independently construct file paths from user-provided input without invoking the global path-sanitization guards introduced in GHSA-c8r8-95hg-mp34.\nThe attack flow requires an attacker to possess valid administrative credentials. Once authenticated, the attacker can manipulate the *path parameter in the HTTP request to the vulnerable endpoints. Because the backend does not correctly validate or sanitize these paths against the restricted list, the application resolves the path relative to the intended data directory and traverses into unauthorized, sensitive directories.\nSpecific exploitation targets include the data/.siyuan/publishAccess.json file, which contains sensitive information such as plaintext publish-mode passwords, and arbitrary files stored under the data/templates/ directory. By providing traversal sequences (e.g., ../) in the path parameter, an attacker can escape the intended root directory to access sensitive configuration or template files that should remain unreachable via the web interface.\nThe affected components are the server-side route handlers in kernel/server/serve.go. This flaw persists across all versions of SiYuan before 3.8.1. The failure effectively invalidates the security posture established by the GHSA-c8r8-95hg-mp34 patch for these specific endpoints, demonstrating an incomplete implementation of the intended security policy."
}