CVE-2026-77086: SiYuan before v3.7.4 Path Traversal via packageName
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.4 - Configuration
Ensure SiYuan validates the packageName parameter in Bazaar install and uninstall endpoints to prevent path traversal via directory traversal sequences.
SiYuan Bazaar install/uninstall endpoints packageName input validation = Reject path traversal sequences (directory traversal sequences) in packageName parameter
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have authenticated administrator access to SiYuan. The vulnerable functionality is the Bazaar install and uninstall endpoints.
What could an attacker do with successful exploitation?
A crafted packageName value containing directory traversal sequences can cause install operations to write arbitrary files to any location. Uninstall operations can recursively delete directories.
Which versions are affected?
SiYuan versions before v3.7.4 are affected. Upgrading to v3.7.4 or later removes the affected version range described in the advisory.
How can I assess whether an attempted exploit occurred?
Review Bazaar install and uninstall activity for packageName values containing directory traversal sequences. Investigate unexpected file writes outside intended package locations and unexpected recursive directory deletions.