CVE-2026-100638: SiYuan before v3.8.4 Path Traversal via setNotebookIcon
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook parameter to escape the workspace data directory and write conf.json files to arbitrary locations accessible by the kernel process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a SiYuan administrator. Exploitation also requires network access to the vulnerable endpoint; no user interaction is required.
What access does successful exploitation provide?
The attacker can use traversal sequences in the notebook parameter to escape the workspace data directory, create directory trees, and write conf.json files to locations accessible by the kernel process. The issue affects integrity and availability, with no confidentiality impact indicated.
Which versions are affected?
SiYuan versions before v3.8.4 are affected. Upgrading to v3.8.4 or later addresses the affected version range described.