CVE-2026-100636: SiYuan Path Traversal Vulnerability

CVE-2026-100636 Overview

SiYuan is an open-source personal knowledge management application. Versions before v3.8.4 contain a path traversal vulnerability [CWE-22] in the exportBrowserHTML endpoint. An authenticated administrator can supply a folder parameter containing directory traversal sequences to escape the intended export directory. The attacker can then overwrite index.html in any kernel-writable location on the host. Successful exploitation enables stored cross-site scripting (XSS) or workspace defacement by writing arbitrary HTML content outside the workspace boundary.

Critical Impact
Authenticated attackers can write arbitrary HTML content outside the workspace directory, enabling stored XSS and persistent compromise of the SiYuan interface.

Affected Products

SiYuan versions prior to v3.8.4
SiYuan exportBrowserHTML endpoint
Deployments exposing the SiYuan kernel to authenticated administrators

Discovery Timeline

2026-09-26 - CVE-2026-100636 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100636

Vulnerability Analysis

The vulnerability resides in the exportBrowserHTML endpoint of the SiYuan kernel. The endpoint accepts a folder parameter that specifies the destination for exported HTML content. The kernel fails to sanitize or canonicalize this parameter before writing the output file. An authenticated administrator can submit a folder value containing ../ traversal sequences to break out of the export directory. The kernel then writes index.html to a controlled filesystem location with attacker-supplied HTML content.

Because the written file is an HTML document, the primary exploitation outcome is stored XSS. When a user later loads the overwritten index.html through the SiYuan interface or any kernel-served path, the attacker-controlled script executes in the browser context. The vulnerability also allows workspace defacement by overwriting application UI assets.

Root Cause

The root cause is missing path validation on the folder request parameter. The kernel concatenates user input into the output file path without resolving the final canonical location against the permitted export directory. This is a classic [CWE-22] path traversal pattern where trusted administrative input is treated as safe.

Attack Vector

Exploitation requires authenticated administrator access to the SiYuan kernel over the network. The attacker submits a crafted request to the exportBrowserHTML endpoint with a folder parameter containing traversal sequences such as ../../target_directory. The endpoint writes index.html to the resolved location, overwriting any pre-existing file at that path. The attacker controls the HTML payload, enabling injection of arbitrary JavaScript. No user interaction is required beyond the initial authenticated session. See the GitHub Security Advisory GHSA-jf98-m24w-gm9m and the VulnCheck Advisory for additional technical context.

Detection Methods for CVE-2026-100636

Indicators of Compromise

Requests to the exportBrowserHTML endpoint containing ../ or URL-encoded %2e%2e%2f sequences in the folder parameter.
Unexpected index.html files appearing or being modified outside the configured SiYuan workspace directory.
HTML files on disk containing unexpected <script> tags or references to attacker-controlled domains.

Detection Strategies

Inspect SiYuan kernel access logs for POST requests to exportBrowserHTML with traversal payloads in the folder field.
Correlate administrator session activity with filesystem write events outside the workspace path.
Deploy file integrity monitoring on directories writable by the SiYuan kernel process to detect unauthorized index.html modifications.

Monitoring Recommendations

Alert on any write operations to index.html files that originate from the SiYuan kernel process outside the designated workspace tree.
Monitor administrator authentication events and session reuse against the kernel API.
Capture and retain kernel request bodies for export endpoints to support post-incident forensics.

How to Mitigate CVE-2026-100636

Immediate Actions Required

Upgrade SiYuan to version v3.8.4 or later, which contains the official fix.
Audit administrator accounts and rotate credentials for any account that may have been exposed.
Review the filesystem for unexpected index.html files and restore known-good copies from backup.

Patch Information

The vendor released a patched build in SiYuan v3.8.4. The fix validates the folder parameter supplied to the exportBrowserHTML endpoint and prevents resolved paths from escaping the configured export directory. Refer to the GitHub Security Advisory GHSA-jf98-m24w-gm9m for release details.

Workarounds

Restrict network access to the SiYuan kernel so that only trusted administrators can reach the HTTP API.
Run the SiYuan kernel under a dedicated low-privilege user with filesystem write permissions limited to the workspace directory.
Disable or proxy-filter the exportBrowserHTML endpoint until the upgrade can be applied.

bash

# Configuration example: restrict kernel exposure with a reverse proxy allowlist
# nginx snippet limiting access to the SiYuan kernel API
location /api/export/exportBrowserHTML {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://127.0.0.1:6806;
}