CVE-2026-109309
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's…
- Risk score
- 45/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readabl…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.8.6 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.
Last activity 12 Oct 2026. Patch Forecast updates every hour.