CVE-2026-77086 Overview
CVE-2026-77086 is a path traversal vulnerability in SiYuan, a self-hosted personal knowledge management application. Versions before v3.7.4 fail to validate the packageName parameter accepted by the Bazaar install and uninstall endpoints. Authenticated administrators can supply directory traversal sequences to escape the intended package directory. Successful exploitation lets attackers write arbitrary files anywhere the SiYuan process can reach, or recursively delete arbitrary directories through the uninstall handler. The flaw is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
Authenticated administrators can achieve arbitrary file write and arbitrary directory deletion on the host running SiYuan, enabling remote code execution and destructive data loss.
Affected Products
- SiYuan versions prior to v3.7.4
- SiYuan Bazaar install endpoint
- SiYuan Bazaar uninstall endpoint
Discovery Timeline
- 2026-08-21 - CVE-2026-77086 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77086
Vulnerability Analysis
SiYuan exposes a Bazaar subsystem that installs and removes community packages such as themes, templates, and plugins. Both the install and uninstall handlers accept a packageName value from the client and use it to construct filesystem paths under the SiYuan data directory. The application does not normalize the input or reject traversal sequences such as ../ before joining the value into a target path.
An authenticated administrator can therefore steer file operations outside the intended Bazaar directory. On install, the server writes package contents to a caller-controlled path, producing arbitrary file write primitives. On uninstall, the server performs a recursive delete on a caller-controlled path, producing arbitrary directory deletion. Because SiYuan is typically self-hosted, the process often runs with permissions to reach configuration files, startup scripts, and user data.
Root Cause
The root cause is missing input validation on the packageName parameter. The endpoints trust caller-supplied strings and pass them into path-joining logic without canonicalization, allow-listing, or containment checks against the Bazaar root directory.
Attack Vector
Exploitation requires network access to the SiYuan HTTP interface and valid administrator credentials. An attacker issues a crafted install request whose packageName contains traversal sequences, causing package files to be written to attacker-chosen locations. Overwriting startup scripts, cron entries, or web-accessible assets escalates the primitive to remote code execution. Alternatively, an uninstall request with a traversal payload can recursively delete directories such as user notes or system paths reachable by the process.
No verified proof-of-concept code has been published. Technical details are available in the GitHub Security Advisory GHSA-wr4w-7vjm-mmx3 and the VulnCheck Advisory on SiYuan.
Detection Methods for CVE-2026-77086
Indicators of Compromise
- HTTP requests to Bazaar install or uninstall endpoints containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths inside the packageName field.
- Files created outside the SiYuan Bazaar directory with modification timestamps that align with Bazaar API activity.
- Unexpected deletion of files or directories under paths writable by the SiYuan service account.
- New or modified executables, startup scripts, or web assets placed by the SiYuan process user.
Detection Strategies
- Parse SiYuan access logs for POST requests to Bazaar install/uninstall routes and flag any packageName value containing traversal metacharacters.
- Compare filesystem baselines of the SiYuan host to detect writes outside the expected Bazaar data subtree.
- Correlate administrator authentication events with Bazaar API calls to surface anomalous package operations.
Monitoring Recommendations
- Enable filesystem auditing on the SiYuan installation directory and adjacent system paths.
- Forward SiYuan application logs and host telemetry to a centralized SIEM for retention and correlation.
- Alert on any Bazaar operation performed outside of documented change windows.
How to Mitigate CVE-2026-77086
Immediate Actions Required
- Upgrade SiYuan to version v3.7.4 or later on all self-hosted and containerized deployments.
- Rotate administrator credentials and API tokens if the instance was exposed to untrusted networks.
- Audit the SiYuan host for unauthorized files, deleted directories, and unexpected scheduled tasks.
Patch Information
The SiYuan maintainers addressed CVE-2026-77086 in v3.7.4 by validating the packageName parameter in the Bazaar install and uninstall endpoints. Refer to the GitHub Security Advisory GHSA-wr4w-7vjm-mmx3 for release details.
Workarounds
- Restrict network exposure of the SiYuan HTTP interface to trusted hosts using a reverse proxy or firewall rules until patching is complete.
- Enforce strong, unique administrator passwords and disable unused administrator accounts to reduce the pool of viable attackers.
- Run SiYuan under a least-privileged service account that cannot modify system directories or startup scripts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
