| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/siyuan-note/siyuan/kernel | < 3.5.10all versions | 3.5.10 |
| siyuan | < 3.5.10 | 3.5.10 |
A path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code.
Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE).
File: serve.go, session.go Lines: serve.go 303, 315, 320, 340, 955-957; session.go 292-295
Vulnerable Code:
// session.go
if localhost {
if strings.HasPrefix(c.Request.RequestURI, "/assets/") || strings.HasPrefix(c.Request.RequestURI, "/export/") {
c.Set(RoleContextKey, RoleAdministrator)
c.Next()
return
}
}
// serve.go
filePath := strings.TrimPrefix(c.Request.URL.Path, "/export/")
decodedPath, err := url.PathUnescape(filePath)
fullPath := filepath.Join(exportBaseDir, decodedPath)
c.File(fullPath)
// CORS
c.Header("Access-Control-Allow-Origin", "*")
Points of Vulnerability:
/export/* trusts url.PathUnescape output and joins it without enforcing fullPath to stay under exportBaseDir.%252e%252e) bypasses ServeFile dot-dot URL rejection but is decoded by app logic into ...CheckAuth grants admin for localhost requests to /export/* when access auth code is set.Access-Control-Allow-Origin: * allows hostile web pages to read localhost responses.Reproduction Steps:
Send a GET request to /export/%252e%252e/%252e%252e/conf/conf.json or export/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd
If HTTP 200 is returned, inspect the response body for sensitive fields:
api.token
cookieKey
accessAuthCode
or
/etc/passwd
POST /api/system/getNetwork
Header: Authorization: Token <leaked token>
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeThis vulnerability can lead to serious compromise of a SiYuan instance, including:
Arbitrary File Disclosure
Exposure of Sensitive Secrets
Administrative API Access
Cross‑Origin Localhost Data Exfiltration
Access-Control-Allow-Origin: *, a malicious website can exploit the vulnerability to read files from a victim's local SiYuan instance running on 127.0.0.1.Potential Remote Code Execution (RCE)