CVE-2026-100636 in SiYuan
Summary
by MITRE • 09/26/2026
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, enabling stored XSS or workspace defacement.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in SiYuan versions prior to v3.8.4 represents a critical path traversal flaw located within the exportBrowserHTML endpoint of the application's backend logic. This security defect arises from insufficient validation and sanitization of user-supplied input, specifically the folder parameter passed during HTML export operations. Although the system is designed to restrict file writes to specific workspace directories for data integrity and isolation purposes, the underlying implementation fails to properly canonicalize or verify the target path against a strict allowlist or root directory constraint. This oversight allows an authenticated administrator to manipulate the filesystem navigation sequence by injecting directory traversal characters, such as dot-dot-slash sequences, into the folder parameter. By doing so, the attacker can bypass the intended sandboxing mechanisms and direct file write operations to arbitrary locations on the server's filesystem that are writable by the application kernel process.
The operational impact of this vulnerability is severe due to its potential for persistent code execution and system compromise. An authenticated administrator with access to this endpoint can overwrite index.html files in any pre-existing directory where the service has write permissions, not limited to the intended workspace folder. This capability enables two primary attack vectors: stored cross-site scripting (XSS) and application defacement. If an attacker targets a web-accessible location containing an index file that serves as a landing page or entry point for other services, they can inject malicious JavaScript payloads directly into the HTML structure. When users subsequently access this compromised page, their browsers will execute the injected scripts in the context of the vulnerable domain, potentially leading to session hijacking, credential theft, or further lateral movement within the network environment depending on the privileges associated with those user sessions.
From a classification perspective, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements that could allow paths to traverse outside the intended directory structure. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic TA0001: Initial Access and specifically the Tactic of Execution via web application attacks. The ability to write arbitrary content to a served HTML file facilitates persistent access mechanisms often categorized under persistence techniques such as Web Shell or Server-Side Request Forgery if leveraged in conjunction with other vulnerabilities, though here it primarily serves as a vector for client-side code injection through server-side manipulation.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to upgrade SiYuan to version v3.8.4 or later, where the developers have addressed this path traversal issue by implementing robust input validation and strict path canonicalization checks before any file system operations are executed. In environments where upgrading is not immediately feasible, administrators should implement network-level controls such as web application firewalls that can detect and block requests containing directory traversal patterns in parameters associated with file write endpoints. Additionally, enforcing the principle of least privilege by running the SiYuan service under a restricted user account with minimal filesystem permissions can limit the scope of damage even if an attacker successfully exploits this vulnerability. Regular security audits focusing on input validation for all file system interactions are essential to prevent similar path traversal issues in other components of the application stack.