[ CVE-2026-109309 · Published 12 Oct 2026 ]
Vulnerability in siyuan-note siyuan
CVSS 6.5
EPSS <1%No fix listed yet
[ Description ]Official description
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.