Description
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | 3.7.0 – < 3.8.6 | 3.8.6 |
References
- GitHub Security Advisory (GHSA-phmw-4rgv-r4xv) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path third-party-advisory