CVE-2026-69086 in siyuan
Summary
by MITRE • 08/03/2026
SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope database content.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability identified in SiYuan versions prior to v3.7.3 represents a critical path traversal flaw that fundamentally undermines the application's security boundaries within its attribute-view functionality. This weakness manifests as inadequate input validation specifically targeting the avID parameter across all code execution paths in read endpoints, creating an exploitable condition where malicious actors can manipulate file access patterns to escape designated storage directories. The vulnerability affects both authenticated users with RoleReader permissions and anonymous clients when publish authentication is disabled, significantly broadening the attack surface and potential impact scope.
The technical implementation of this flaw allows attackers to construct specially crafted traversal paths that bypass normal directory restrictions imposed by the application's file system access controls. When the avID parameter fails validation, it enables path manipulation techniques that can navigate beyond the intended attribute-view storage directory boundaries. This occurs because the application does not properly sanitize or validate user-supplied identifiers before using them in file system operations, creating a direct pathway for unauthorized file access. The vulnerability essentially permits arbitrary file reading capabilities that extend far beyond the legitimate scope of database content access.
The operational impact of this vulnerability extends beyond simple data disclosure, as it enables cross-scope database content exposure that can compromise sensitive information across multiple database contexts within the SiYuan application. Authenticated users with minimal privileges can exploit this weakness to access JSON files containing database structures, configuration details, or other sensitive metadata that should remain isolated within their respective scopes. Anonymous access when publish authentication is disabled amplifies the threat model significantly, as it removes the requirement for valid credentials while maintaining the same privilege escalation capabilities. This creates a scenario where any external attacker can potentially extract structured data from the system's database layers.
Security mitigations for this vulnerability must address the fundamental lack of input validation within the attribute-view read endpoints, requiring comprehensive parameter sanitization and path validation mechanisms. The fix should implement strict validation of the avID parameter to ensure it conforms to expected patterns and does not contain traversal sequences that could escape directory boundaries. Additionally, the application should enforce proper access controls that maintain clear scope separation between different database contexts, preventing unauthorized cross-scope data access even when path traversal attempts are made. This vulnerability aligns with common weakness enumerations such as CWE-22 Path Traversal and CWE-73 Path Traversal in multiple execution contexts, representing a classic example of insufficient input sanitization that enables privilege escalation through file system manipulation techniques.
The exploitation of this vulnerability demonstrates the importance of proper input validation at all levels of application code execution, particularly within endpoints that handle user-supplied identifiers for file operations. Organizations utilizing SiYuan should implement immediate patching procedures to upgrade to version 3.7.3 or later, while also conducting thorough security assessments to identify any potential exploitation attempts. The ATT&CK framework would categorize this vulnerability under technique T1083 File and Directory Discovery and potentially T1566 Phishing with Social Engineering, as the path traversal mechanism enables comprehensive reconnaissance of the application's file system structure and database content access patterns.