CVE-2026-100636: SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, enabling stored XSS or workspace defacement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as an administrator. The vulnerable endpoint is network-accessible, so any administrator able to reach the SiYuan instance could submit a crafted export request.
What access or conditions are required for a successful overwrite?
The attacker needs a target location that already exists and is writable by the SiYuan kernel process. The issue overwrites index.html and cannot be used, based on the available information, to write arbitrary filenames.
Are default deployments affected?
The provided information identifies SiYuan versions before v3.8.4 as affected, but does not state whether the exportBrowserHTML endpoint is enabled or reachable in a default deployment.
What is the impact if exploitation succeeds?
An attacker can escape the workspace export directory and write attacker-controlled HTML to index.html in a kernel-writable location. This can result in stored cross-site scripting or workspace defacement.