SiYuan note app bug can leak private note data

Published September 3, 2026 CVE-2026-69086

SiYuan is a note-taking app that stores notes in a personal workspace. A bug lets someone read private note database files they should never be able to see, by tricking the app into fetching a file outside its normal folder.

Severity
HighCVSS 3.1 · 7.7
Fix
Fixed in 0.0.0-20260720151813-0f5a0e7c67b0Fix recorded on Sep 3, 2026
Affected versions
before 0.0.0-20260720151813-0f5a0e7c67b0
Weakness
CWE-22Path Traversal
Exploit likelihood
0.35% in 30 daysEPSS, higher than 28% of known flaws
Affects
SiYuan

How it works

Several SiYuan features that load structured note data (called attribute views) take an ID from the request and build a file path from it without checking for folder-jump sequences../, so a crafted ID can pull a JSON file from outside the notes database folder.

What to do

Check your SiYuan version in the app's About screen or settings. Anything before v3.7.3 is affected, and risk is higher if you have publish authentication disabled or share workspaces with reader accounts.

Update SiYuan to v3.7.3 or later through the app's normal update channel, and turn on publish authentication if you use the sharing feature.

Technical details

Four endpoints (renderAttributeView, getAttributeViewKeysByID, getAttributeViewKeys, getCurrentAttrViewImages) build a filesystem path from a caller-supplied id/avID and read it under DataDir/storage/av/ without confining the result to that directory. The only identifier format check, ast. IsNodeIDPattern, sits inside the create-if-missing branch, so the load path never validates the ID and a path containing../ escapes storage/av/ to read arbitrary JSON files in the workspace. These endpoints require only CheckAuth, which a publish RoleReader token satisfies, and when Publish.Auth.Enable is false the publish proxy uses an anonymous account, making it reachable without credentials.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source