CVE-2026-100637: SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON files in pre-existing kernel-writable directories outside workspace boundaries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as an administrator. The vulnerable checkoutRepo endpoint is network-accessible, and no user interaction is required.
What must be true for an overwrite to succeed?
The attacker must supply directory-traversal sequences in the sessionID parameter and target an existing directory that the SiYuan kernel can write to. The vulnerability is limited to writing JSON files outside the workspace.
Are default deployments affected?
The provided information does not identify any configuration prerequisite beyond running a SiYuan version before v3.8.4 and allowing an authenticated administrator to reach the checkoutRepo endpoint.
How can I determine whether an instance is affected?
Instances running SiYuan before v3.8.4 are affected. Review administrator activity involving the checkoutRepo endpoint and sessionID values containing directory-traversal sequences, and inspect kernel-writable directories outside the workspace for unexpected JSON-file changes.