N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-hjh7-r5w8-5872

GHSA-hjh7-r5w8-5872: SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)

Summary

The fix for CVE-2026-30869 in SiYuan v3.5.10 only added a denylist check (IsSensitivePath) but did not address the root cause — a redundant url.PathUnescape() call in serveExport(). An authenticated attacker can use double URL encoding (%252e%252e) to traverse directories and read arbitrary workspace files including the full SQLite database (siyuan.db), kernel log, and all user documents.

Details

In kernel/server/serve.go, the serveExport() function (line 314-320) processes file paths as follows:

filePath := strings.TrimPrefix(c.Request.URL.Path, "/export/")
decodedPath, err := url.PathUnescape(filePath)     // second decode
fullPath := filepath.Join(exportBaseDir, decodedPath)

Go's HTTP server already decodes percent-encoded characters once during request parsing. The additional url.PathUnescape() call creates a double-decode vulnerability:

Attacker sends: GET /export/%252e%252e/siyuan.db
Go HTTP decodes %25 → %, result: URL.Path = /export/%2e%2e/siyuan.db
Go's path cleaner sees %2e%2e as literal characters (not ..), no redirect occurs
url.PathUnescape("%2e%2e") decodes to ..
filepath.Join(exportBaseDir, "../siyuan.db") resolves to <workspace>/temp/siyuan.db

The CVE-2026-30869 fix added IsSensitivePath() which blocks <workspace>/conf/ and OS-level paths (/etc, /root, etc.). However, it does NOT block:

<workspace>/temp/siyuan.db — full document database
<workspace>/temp/blocktree.db — block tree database
<workspace>/temp/siyuan.log — kernel log
<workspace>/temp/asset_content.db — asset content database

Note: the /appearance/ handler in the same file correctly uses gulu.File.IsSubPath() to validate paths (line 447), but this check is missing from the /export/ handler.

PoC

poc.zip Please extract the uploaded compressed file before proceeding

docker compose up -d --build
sh poc.sh

Impact

Data exfiltration: An authenticated user (including low-privilege Publish/Reader users via the Publish service) can download the entire SQLite document database containing all blocks, documents, attributes, and full-text search indexes.
Information disclosure: Kernel log (siyuan.log) leaks internal server paths, versions, configuration details, and error messages.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-hjh7-r5w8-5872

GHSA-hjh7-r5w8-5872:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/siyuan-note/siyuan/kernel	go	< 3.6.5	3.6.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security advisory and the associated commit bb481e1290c4a34255652ede85a546504505d2a7 reveals a path traversal vulnerability in the SiYuan application. The root cause is a double URL decoding issue within the serveExport function located in kernel/server/serve.go. The application's request handling involves an extra url.PathUnescape call on a path that has already been decoded by the Go HTTP server. This allows an attacker to craft a request with double-encoded characters (e.g., %252e%252e for ..) to bypass path validation and access arbitrary files.

The primary vulnerable function is serveExport, as it contains the flawed logic that leads to the path traversal. The patch addresses this by introducing a call to gulu.File.IsSubPath to ensure that the requested file path is a legitimate subdirectory of the intended export directory.

Additionally, the function IsSensitivePath in kernel/util/path.go was updated to explicitly block access to files with .db and .log extensions. This is a secondary hardening measure to prevent the disclosure of sensitive data like the application's database and logs, which was possible due to the path traversal vulnerability. While IsSensitivePath is not the source of the path traversal itself, its initial implementation was insufficient to mitigate the impact of the vulnerability, making its modification a key part of the overall fix.

Vulnerable functions

serveExport

kernel/server/serve.go

The `serveExport` function was vulnerable to a path traversal attack. It uses `url.PathUnescape` on a path that has already been unescaped by the web server. This double decoding allows an attacker to use double-URL-encoded path traversal sequences (e.g., `%252e%252e` for `..`) to access files outside of the intended directory. The vulnerability was fixed by adding a check to ensure the resolved file path is within the expected base directory.

IsSensitivePath

kernel/util/path.go

The `IsSensitivePath` function is part of the security controls for the application. It was updated to deny access to database and log files as part of the fix for the path traversal vulnerability. While not the root cause of the path traversal, its previous implementation was insufficient to prevent the leakage of sensitive files like the database and logs, which was a direct impact of the primary vulnerability in `serveExport`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.