CVE-2026-65607

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath checks added in the earlier export-disclosure hardening (GHSA-6865-qjcf-286f). An authenticated attacker can send percent-encoded traversal sequences (e.g. /export/temp/%2e%2e/.../etc/passwd, where %2e%2e is decoded to '..') to read arbitrary files outside TempDir, including /etc/passwd, SSH keys (~/.ssh/*), and SiYuan workspace *.db and *.log files, bypassing the sensitive-file protection.

• CWE-22

• https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gw25-m53r-qh88
• https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-export-temp

Published

Jul 23, 2026

Last Modified

Jul 27, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-65601Traefik versions 3.7.0 through 3.7.6 contain a namespace con…5.3
• CVE-2026-65602Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to…8.8
• CVE-2026-65603The Grav Login plugin (grav-plugin-login) versions <= 3.8.11…8.8
• CVE-2026-65604Skipper contains an incomplete fix for CVE-2026-50197 in whi…8.8
• CVE-2026-65605SiYuan before v3.7.2 contains a stored cross-site scripting …9.6
• CVE-2026-65606SiYuan before v3.7.2 contains a cross-site scripting vulnera…9.6
• CVE-2026-65608Grav versions >= 1.7.0 and before 2.0.9 contain a remote cod…8.8
• CVE-2026-65609nnn is vulnerable to Out-of-Bound write vulnerability. Due t…2.4
• CVE-2026-6561A vulnerability was detected in EyouCMS up to 1.7.1. This is…4.7
• CVE-2026-65610nnn stores homelen variable as uchar_t, which can only repre…2.4
• CVE-2026-65611nnn does not sanitize the path variable. An attacker can cre…5.1
• CVE-2026-65612nnn does not sanitize the filename variable. An attacker can…5.1