CVE-2026-100637: SiYuan Path Traversal Vulnerability

CVE-2026-100637 Overview

CVE-2026-100637 is a path traversal vulnerability [CWE-73] in SiYuan versions before v3.8.4. The flaw resides in the checkoutRepo endpoint, which fails to sanitize the sessionID parameter. Authenticated administrators can supply directory traversal sequences to write JSON files outside the designated workspace boundary. Exploitation allows attackers to overwrite arbitrary JSON files in any kernel-writable directory that already exists on the host. The vulnerability affects the integrity of system and application configuration data outside SiYuan's intended scope.

Critical Impact
Authenticated administrators can overwrite arbitrary JSON files outside the workspace, enabling tampering with configuration data in kernel-writable directories.

Affected Products

SiYuan note-taking application versions before v3.8.4
Deployments exposing the checkoutRepo endpoint to authenticated administrators
Self-hosted SiYuan kernel instances across supported platforms

Discovery Timeline

2026-09-26 - CVE-2026-100637 published to NVD
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-100637

Vulnerability Analysis

The vulnerability exists in the checkoutRepo API endpoint of the SiYuan kernel. The endpoint accepts a sessionID parameter that is subsequently incorporated into a filesystem path used for writing JSON data. SiYuan does not normalize the parameter or validate that the resulting path remains within the workspace directory. An authenticated administrator can submit a crafted sessionID containing ../ sequences to traverse outside the workspace root.

Successful exploitation results in overwriting existing JSON files anywhere the kernel process has write permissions. The scope is limited to JSON file content, but tampering with configuration files can disrupt application behavior, degrade system integrity, or provide a foothold for follow-on attacks. The vulnerability is classified under CWE-73: External Control of File Name or Path.

Root Cause

The root cause is insufficient input validation on the sessionID parameter before it is used in filesystem operations. The code trusts client-supplied input to construct a write path without enforcing path canonicalization or validating that the final resolved path remains within the workspace boundary.

Attack Vector

The attack vector is network-based and requires administrator authentication. An attacker sends an HTTP request to the checkoutRepo endpoint with a sessionID value containing directory traversal sequences such as ../../path/to/target.json. The kernel writes the output JSON to the attacker-specified location, overwriting any existing JSON file at that path if the kernel process holds write permissions. Refer to the GitHub Security Advisory and the VulnCheck Path Traversal Advisory for additional technical context.

Detection Methods for CVE-2026-100637

Indicators of Compromise

JSON files modified outside the SiYuan workspace directory with timestamps correlating to checkoutRepo requests
HTTP requests to the checkoutRepo endpoint containing ../ or encoded traversal sequences in the sessionID parameter
Unexpected changes to application or system JSON configuration files in kernel-writable directories

Detection Strategies

Inspect SiYuan access logs for requests to checkoutRepo where the sessionID parameter contains .., %2e%2e, or absolute path separators
Deploy file integrity monitoring on directories outside the workspace that contain JSON configuration files
Alert on administrator-authenticated API traffic originating from unexpected source addresses

Monitoring Recommendations

Enable verbose logging on the SiYuan kernel to capture full request parameters for authenticated API endpoints
Forward application and filesystem audit events to a centralized data lake for correlation across hosts
Baseline the set of JSON files the SiYuan process writes under normal operation and alert on deviations

How to Mitigate CVE-2026-100637

Immediate Actions Required

Upgrade SiYuan to version v3.8.4 or later on all deployed instances
Review administrator account inventories and rotate credentials where unauthorized access is suspected
Audit JSON files in kernel-writable directories outside the workspace for unexpected modifications

Patch Information

The maintainers addressed the vulnerability in SiYuan v3.8.4 by validating the sessionID parameter and enforcing that resolved file paths remain within workspace boundaries. Patch details are documented in the GitHub Security Advisory GHSA-jhmh-hr4g-c5g2.

Workarounds

Restrict network access to the SiYuan kernel so only trusted hosts can reach administrative endpoints
Run the SiYuan kernel under a least-privileged account that cannot write to sensitive system or application directories
Place the application behind a reverse proxy that filters requests containing path traversal sequences in query parameters

bash

# Reverse proxy filter example (NGINX) to block traversal sequences in sessionID
if ($args ~* "sessionID=[^&]*(\.\./|%2e%2e)") {
    return 400;
}