CVE-2026-30869

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30869", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-06T00:04:56.697Z", "datePublished": "2026-03-09T22:28:06.949Z", "dateUpdated": "2026-03-10T14:18:46.445Z"}, "containers": {"cna": {"title": "SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w"}], "affected": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"version": "< 3.5.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:28:06.949Z"}, "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double\u2011encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10."}], "source": {"advisory": "GHSA-2h2p-mvfx-868w", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T14:18:43.579827Z", "id": "CVE-2026-30869", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:18:46.445Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30869", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T14:18:43.579827Z"}}}], "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:18:38.916Z"}}], "cna": {"title": "SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage", "source": {"advisory": "GHSA-2h2p-mvfx-868w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "< 3.5.10"}]}], "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w", "name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double\u2011encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:28:06.949Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30869", "state": "PUBLISHED", "dateUpdated": "2026-03-10T14:18:46.445Z", "dateReserved": "2026-03-06T00:04:56.697Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-09T22:28:06.949Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "siyuan", "vendor": "siyuan-note", "versions": [{"status": "affected", "version": "< 3.5.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E7B145F-4786-4534-B4D6-A947F4CD06FE", "versionEndExcluding": "3.5.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double\u2011encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10."}, {"lang": "es", "value": "SiYuan es un sistema de gesti\u00f3n de conocimiento personal. Antes de la 3.5.10, una vulnerabilidad de salto de ruta en el endpoint /export permite a un atacante leer archivos arbitrarios del sistema de archivos del servidor. Al explotar secuencias de salto doblemente codificadas, un atacante puede acceder a archivos sensibles como conf/conf.json, que contiene secretos, incluyendo el token de la API, la clave de firma de cookies y el c\u00f3digo de autenticaci\u00f3n de acceso al espacio de trabajo. La filtraci\u00f3n de estos secretos puede habilitar el acceso administrativo a la API del kernel de SiYuan, y en ciertos escenarios de despliegue podr\u00eda potencialmente encadenarse en ejecuci\u00f3n remota de c\u00f3digo (RCE). Esta vulnerabilidad est\u00e1 corregida en la 3.5.10."}], "id": "CVE-2026-30869", "lastModified": "2026-06-17T10:33:03.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30869", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T14:18:43.579827Z", "version": "2.0.3"}}]}, "published": "2026-03-10T17:40:14.380", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.5.10)"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 84.0, "source": "matching"}]}, "original": {"product": "siyuan", "source": "cna", "vendor": "siyuan-note"}, "product": "siyuan", "vendor": "siyuan"}], "analysis": {"en": {"generated_at": "2026-04-17T11:48:17.697694+00:00", "value": {"mitigation_remediation": ["Upgrade SiYuan to version 3.5.10 or newer to apply the vendor\u2011supplied fix.", "If an upgrade cannot be performed immediately, restrict network exposure of the SiYuan instance so that the /export endpoint is reachable only from trusted hosts or internal IP ranges.", "Move or protect sensitive files such as conf/conf.json from the directories that can be served via path traversal, ensuring that even if traversal succeeds the attacker cannot read them.", "Monitor evaluation logs for unusual /export activity and apply additional intrusion detection if available."], "summary": {"action": "Patch", "impact": "Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "Siyuan, the personal knowledge\u2011management application distributed by siyuan-note, is vulnerable in all releases before version 3.5.10. The CPE library lists the product as b3log:siyuan and the CNA indicates affected vendors/products as siyuan-note:siyuan. No specific sub\u2011version constraints are given beyond the statement that the fix is in 3.5.10.", "description_and_impact": "The vulnerability arises from a path traversal flaw (CWE\u201122) that is bypassed when double\u2011encoded traversal sequences are used against the /export endpoint of the SiYuan knowledge\u2011management system. This flaw allows an attacker to craft an HTTP request that retrieves arbitrary file paths and obtains the contents of any file that the server process can read. Exposure of locally stored configuration files, such as conf/conf.json, can leak API tokens, cookie signing keys and workspace authentication secrets. These credentials could grant the attacker administrative access to the SiYuan kernel API and, in certain deployment scenarios, the attacker could subsequently achieve remote code execution.", "risk_and_exploitability": "The CVSS score is 9.3, marking the flaw as critical. The EPSS rating of less than 1\u202f% suggests an extremely low probability of widespread exploitation as recorded in current data, and the vulnerability has not been listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote over the network. The necessary conditions are that the attacker can reach the victim\u2019s SiYuan instance and that it runs a version older than 3.5.10. Once executed, the attacker can read sensitive files and may leverage the extracted secrets to gain administrative privileges, potentially chaining into remote code execution depending on the deployment configuration."}}}}, "created": "2026-03-10T14:06:34.420036+00:00", "updated": "2026-04-17T12:00:11.739392+00:00", "vendors": ["siyuan", "siyuan$PRODUCT$siyuan"]}