CVE-2026-100637 in SiYuan
Summary
by MITRE • 09/26/2026
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON files in pre-existing kernel-writable directories outside workspace boundaries.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The security flaw identified in SiYuan versions prior to v3.8.4 represents a critical path traversal vulnerability located within the checkoutRepo endpoint of the application's backend logic. This specific weakness stems from an insufficient validation mechanism when processing user-supplied input, particularly the sessionID parameter which is intended for authentication and session management purposes but is erroneously utilized in file system operations without proper sanitization. By injecting directory traversal sequences such as dot-dot-slash into this parameter, a malicious actor can manipulate the underlying file path resolution logic to escape the designated workspace boundaries. This architectural oversight allows the application to interpret relative paths incorrectly, leading it to write data to arbitrary locations on the host operating system rather than restricting writes to the intended sandboxed environment.
From an operational perspective, the impact of this vulnerability is severe due to its requirement for administrative privileges combined with the ability to overwrite critical configuration files. While the attack vector requires authentication as an administrator, which limits the pool of potential attackers, it does not mitigate the severity because compromised admin credentials are a common outcome in broader network intrusions or through social engineering attacks. The core danger lies in the capability to write JSON files outside the workspace directory structure. Since many system services and applications rely on specific configuration files stored in standard directories such as /etc or other kernel-writable locations, overwriting these files can lead to significant service disruption, privilege escalation, or remote code execution if the overwritten file is subsequently read by a privileged process with different security contexts than the web application itself.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The exploitation technique involves manipulating input variables to access resources that are outside the intended directory scope, bypassing standard file system permissions and application-level restrictions. Furthermore, this behavior can be mapped to MITRE ATT&CK techniques related to Defense Evasion or Persistence, specifically where an attacker modifies configuration files to maintain access or alter security controls. The ability to write arbitrary JSON files suggests potential for further exploitation chains, such as injecting malicious payloads into startup scripts or modifying application settings to disable logging or authentication mechanisms entirely.
To mitigate this risk, immediate patching to version v3.8.4 or later is required, as the vendor has addressed the input validation logic in the checkoutRepo endpoint. In addition to upgrading, administrators should implement strict allow-listing for file paths within their web applications to ensure that all write operations are confined strictly to designated directories. Input sanitization must be enforced at multiple layers, including both client-side and server-side validations, with special attention paid to parameters involved in file system interactions. Regular security audits focusing on path resolution logic and the principle of least privilege for application processes will further reduce the attack surface by ensuring that even if a traversal attempt succeeds, the underlying operating system permissions prevent access to sensitive kernel-writable directories outside the workspace scope.