SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

Summary

SiYuan's /export/ file handler was hardened against export disclosure (issue #12213) by adding an IsSubPath(exportBaseDir, fullPath) check and an IsSensitivePath() check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit branch:

if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") {
    c.File(filepath.Join(util.TempDir, c.Request.URL.Path))
    return
}

This branch joins the broader util.TempDir with the raw, percent-decoded request path and serves it with neither IsSubPath nor IsSensitivePath. An authenticated request to /export/temp/%2e%2e/.../etc/passwd traverses out of TempDir and reads arbitrary files - exactly the sensitive-file disclosure the patch intended to prevent. Present in the latest master.

Affected

• From commit bb481e1 (the hardening) through the latest master.
• Requires SiYuan access authorization (model.CheckAuth) - but the patch's stated goal is to deny sensitive-file export even to authorized callers.

Root cause

kernel/server/serve.go serveExport(): the main branch has IsSubPath + IsSensitivePath; the /export/temp/ short-circuit branch (above it) has neither and uses util.TempDir as its root. c.Request.URL.Path is percent-decoded by net/http, so %2e%2e becomes .. and filepath.Join collapses it.

Incomplete-fix lineage

• Export disclosure (issue #12213; CVE-2026-30869) -> fix bb481e1 / d68bd5a (GHSA-6865-qjcf-286f): guards on the main branch + IsSensitivePath extended to *.db/*.log.
• Follow-up CVE-2026-41894 (GHSA-hjh7-r5w8-5872) in the same /export path family.
• The /export/temp/ short-circuit branch was never covered by the guards (this report).

Proof of concept (benign)

1. Authenticate (access auth code).
2. GET /export/<sensitive> (main branch) -> 401/403 (guards work).
3. GET /export/temp/%2e%2e/%2e%2e/.../tmp/<planted-marker> (or ) -> 200 + file content, demonstrating the unguarded traversal. The PoC reads only a planted marker / ; no credentials.