CVE-2026-69086: SiYuan Path Traversal Vulnerability

CVE-2026-69086 Overview

CVE-2026-69086 is a path traversal vulnerability [CWE-22] affecting SiYuan, a personal knowledge management application, in all versions before v3.7.3. The flaw resides in attribute-view read endpoints that fail to validate the avID parameter across all code branches. Attackers can craft traversal sequences that escape the intended storage directory and read arbitrary JSON files on the host. Authenticated users holding RoleReader permissions can exploit the flaw, and unauthenticated clients can exploit it when publish authentication is disabled.

Critical Impact
Attackers can read JSON files outside the attribute-view directory, disclosing cross-scope database content and potentially exposing sensitive notebook data.

Affected Products

SiYuan versions prior to v3.7.3
Deployments exposing attribute-view read endpoints to authenticated RoleReader users
SiYuan instances with publish authentication disabled (accessible to anonymous clients)

Discovery Timeline

2026-08-03 - CVE-2026-69086 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-69086

Vulnerability Analysis

SiYuan exposes attribute-view read endpoints that accept a client-supplied avID parameter to locate JSON files representing database views. The application resolves this identifier into a file path under its attribute-view storage directory, but not every code branch applies validation or canonicalization. Requests that embed directory traversal sequences reach the file system layer intact, allowing attackers to escape the intended storage root.

Exploitation returns the raw JSON contents of files located outside the attribute-view directory. Because SiYuan stores structured database records as JSON on disk, the disclosure crosses scope boundaries between notebooks, workspaces, and internal application state. Confidentiality impact is high; integrity and availability are unaffected because the endpoints only read data.

The attack surface expands significantly when publish authentication is disabled. In that configuration, anonymous network clients can trigger the same file read primitive, removing the RoleReader prerequisite and lowering the barrier to mass exploitation.

Root Cause

The root cause is inconsistent input validation. Several code paths that handle the avID parameter do not reject or sanitize traversal sequences such as ../ before joining the value to the storage directory. This is a classic CWE-22 improper limitation of a pathname to a restricted directory.

Attack Vector

An attacker sends an HTTP request to an attribute-view read endpoint with an avID value crafted to traverse out of the attribute-view storage directory and reference an arbitrary JSON file. The server resolves the manipulated path, opens the target file, and returns its contents in the response body. No user interaction is required, and the attack works over the network.

Technical details are documented in the GitHub Security Advisory GHSA-7hm9-v7vf-7g4w and the VulnCheck Advisory.

Detection Methods for CVE-2026-69086

Indicators of Compromise

HTTP requests to SiYuan attribute-view endpoints containing ../, ..\, or URL-encoded variants (%2e%2e%2f) inside the avID parameter.
Responses returning JSON payloads whose contents do not match the requested attribute-view scope.
Access log entries showing anonymous clients reaching attribute-view endpoints on instances where publish authentication was disabled.

Detection Strategies

Inspect web server and reverse proxy logs for avID parameter values that contain traversal metacharacters or unusually long path segments.
Alert on requests to attribute-view read endpoints originating from accounts limited to RoleReader permissions when they exceed baseline access volumes.
Correlate anomalous file read patterns on the SiYuan data directory with concurrent inbound HTTP activity.

Monitoring Recommendations

Enable verbose access logging on the SiYuan process and forward logs to a centralized analytics platform for retention and correlation.
Track the running SiYuan version across all hosts and flag any instance below v3.7.3 for immediate remediation.
Monitor for configuration drift where publish authentication becomes disabled on internet-exposed deployments.

How to Mitigate CVE-2026-69086

Immediate Actions Required

Upgrade SiYuan to v3.7.3 or later on every host running the application.
Re-enable publish authentication on any instance where it has been turned off, particularly on internet-facing deployments.
Audit user accounts and remove RoleReader access that is no longer required.
Review attribute-view access logs for the presence of traversal sequences in the avID parameter and investigate matching requests.

Patch Information

The vendor addressed CVE-2026-69086 in SiYuan v3.7.3 by validating the avID parameter on all code branches of the attribute-view read endpoints. Refer to the GitHub Security Advisory GHSA-7hm9-v7vf-7g4w for release notes and patch commits.

Workarounds

Place SiYuan behind a reverse proxy that rejects requests where the avID parameter contains .., %2e%2e, or backslash sequences.
Restrict network exposure of SiYuan to trusted networks or VPN clients until the upgrade is applied.
Disable anonymous publish access so that authentication is required for all attribute-view endpoints.

bash

# Example NGINX rule to block traversal attempts in the avID parameter
location /api/av/ {
    if ($args ~* "avID=[^&]*(\.\.|%2e%2e)") {
        return 400;
    }
    proxy_pass http://siyuan_backend;
}