CVE-2026-109309: SiYuan Path Traversal Vulnerability

CVE-2026-109309 Overview

CVE-2026-109309 is an absolute path traversal vulnerability [CWE-22] in SiYuan, a personal knowledge management application. Affected versions span SiYuan v3.7.0 through versions before v3.8.6. The kernel's private plugin HTTP server passes a plugin handler's ResponseFile.Path directly to gin's Context.File without validating that the path resolves inside the workspace. An attacker who can supply a malicious kernel plugin can return an absolute path and read any file readable by the SiYuan process, including the API token and conf.json.

Critical Impact
Successful exploitation discloses sensitive files from the host, including the SiYuan API token in conf.json, enabling further compromise of the user's knowledge base.

Affected Products

SiYuan v3.7.0 through versions before v3.8.6
SiYuan kernel private plugin HTTP server (kernel/plugin/server.go)
Deployments that load third-party or untrusted kernel plugins

Discovery Timeline

2026-10-12 - CVE-2026-109309 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109309

Vulnerability Analysis

SiYuan exposes a private HTTP service that kernel plugins use to serve static assets to the application UI. The service accepts a ResponseFile structure from the plugin handler and forwards the Path field to gin's Context.File method. The kernel performs no normalization or workspace containment check on this path. A malicious plugin can set Path to an absolute location outside the workspace, such as /etc/passwd or the SiYuan configuration directory. Gin reads the file from disk and returns its contents in the HTTP response.

Root Cause

The root cause is missing path validation in the plugin service contract. The ResponseFile.Path field was documented as a workspace-relative path such as /data/plugins/<plugin-name>/app/index.html, but the kernel never enforced that constraint. The patched definition explicitly states the path must resolve inside the workspace, otherwise the kernel answers 404. This is a classic failure to canonicalize and compare against an allow-listed base directory before serving a file.

Attack Vector

Exploitation requires an attacker-controlled kernel plugin to be installed and user interaction to activate it. Once loaded, the plugin returns a ResponseFile whose Path points to an arbitrary absolute path on the host filesystem. Any file readable by the SiYuan process is disclosed, including the API token stored in conf.json. The disclosed token can be reused to authenticate against SiYuan's kernel API and operate on the victim's notes.

// Patch to kernel/plugin/service_contract.go - ResponseFile definition
type ResponseFile struct {
    Name string `json:"name"` // e.g. "index.html". If Name is not empty, the file will be sent with Content-Disposition header.
    // Before patch:
    // Path string `json:"path"` // e.g. "/data/plugins/<plugin-name>/app/index.html"
    // After patch:
    Path string `json:"path"` // must resolve inside the workspace, otherwise the kernel answers 404
}

Source: GitHub Commit c6494375

Detection Methods for CVE-2026-109309

Indicators of Compromise

Unexpected HTTP responses from the SiYuan kernel private plugin service that return file content from paths outside the workspace directory.
Access to or exfiltration of conf.json or the SiYuan API token by a process spawned from an installed plugin.
Installation of unsigned, side-loaded, or recently added kernel plugins from untrusted sources.

Detection Strategies

Audit installed SiYuan plugins and compare against a known-good allow list, flagging plugins not sourced from the official marketplace.
Review SiYuan kernel logs for HTTP 200 responses on the private plugin service that correlate with sensitive file paths.
Monitor filesystem reads by the SiYuan process targeting paths outside the configured workspace root.

Monitoring Recommendations

Enable endpoint telemetry to capture file reads of conf.json and other credential material by the SiYuan binary.
Alert on outbound network traffic from hosts running SiYuan that transmits file-sized payloads shortly after plugin activation.
Track SiYuan version strings across managed endpoints to identify hosts still running v3.7.0 through v3.8.5.

How to Mitigate CVE-2026-109309

Immediate Actions Required

Upgrade SiYuan to v3.8.6 or later on all endpoints and servers.
Remove any kernel plugins that were installed from untrusted sources or whose provenance cannot be verified.
Rotate the SiYuan API token stored in conf.json if an untrusted plugin was previously loaded.

Patch Information

The fix is published in commit c6494375ea40ee973f430f0e85d50f1862a30d81 and tracked in GitHub Security Advisory GHSA-phmw-4rgv-r4xv. The patch confines plugin private service file responses to the workspace by canonicalizing ResponseFile.Path with filepath helpers and rejecting paths that resolve outside the workspace with HTTP 404. Additional details are available in the VulnCheck advisory.

Workarounds

Do not install SiYuan kernel plugins from unverified authors until the host is upgraded to v3.8.6.
Run SiYuan under a least-privilege user account so that readable files are limited to the workspace.
Restrict network exposure of the SiYuan kernel service to localhost or a trusted management network.

bash

# Verify installed SiYuan version and plugins directory before upgrading
siyuan --version
ls -la "$HOME/SiYuan/data/plugins/"
# Remove an untrusted plugin
rm -rf "$HOME/SiYuan/data/plugins/<untrusted-plugin-name>"