H3-2026-1048¶

SiYuan Note Attribute View Path Traversal File Read Vulnerability

Description¶

B3log SiYuan Note contains a path traversal vulnerability in the attribute view API endpoints. The getAttributeView and related functions accept arbitrary avID and boxID strings, concatenating them into filesystem paths without validating that they conform to the expected node ID pattern. Remote attackers can supply path traversal sequences such as ../ in the avID parameter to escape the intended storage/av directory and read arbitrary JSON files from the workspace. The vulnerability affects versions prior to v3.7.3 and requires network access to the SiYuan API.

Impact¶

Successful exploitation exposes sensitive workspace data including configuration files and other users' notebook content. Lateral access to stored credentials or API tokens within JSON configuration files is possible. Organizations using SiYuan for collaborative note-taking in enterprise environments face data confidentiality risks.

References¶

• SiYuan GitHub Security Advisory GHSA-7hm9-v7vf-7g4w
• SiYuan v3.7.3 Release Notes
• SiYuan GitHub Issue 18219