Vulnerability · Published Mar 9, 2026 · Assigned by GitHub_M

CVE-2026-30869SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

Critical 9.3

In plain English

A critical-severity path traversal in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)1.2%top 31.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/siyuan-note/siyuan/kernel	3.5.10	GHSA-2h2p-mvfx-868w
Go	github.com/siyuan-note/siyuan/kernel	no fix listed	GO-2026-4646

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	< 3.5.10

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w x_refsource_CONFIRM