Platform
go
Component
github.com/siyuan-note/siyuan/kernel
Fixed in
3.5.11
3.5.10
CVE-2026-30869 is a critical Path Traversal vulnerability discovered in the SiYuan Kernel, a core component of the SiYuan note-taking application. This vulnerability allows attackers to read arbitrary files on the server, potentially exposing sensitive data like configuration files, database credentials, or even source code. The vulnerability affects versions prior to 3.5.10 and has been publicly disclosed. A fix is available in version 3.5.10.
The primary impact of CVE-2026-30869 is the ability for an attacker to read any file accessible to the SiYuan process. This includes configuration files containing database passwords, API keys, and other sensitive credentials. Successful exploitation could lead to complete system compromise, data exfiltration, and potential denial of service. The /export endpoint is the attack vector, allowing an attacker to manipulate file paths to access unauthorized resources. The potential for secret leakage is significant, as the attacker could gain access to internal system information and credentials.
CVE-2026-30869 was publicly disclosed on 2026-03-10. The vulnerability's ease of exploitation, combined with the potential for significant data leakage, suggests a medium probability of exploitation. No public proof-of-concept (POC) code has been released at the time of writing, but the vulnerability's nature makes it likely that a POC will emerge. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.58% (69% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-30869 is to immediately upgrade SiYuan Kernel to version 3.5.10 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the /export endpoint with suspicious path parameters. Specifically, look for requests containing .. sequences in the path. Regularly review file permissions to ensure that the SiYuan process only has access to the files it absolutely needs. After upgrading, confirm the fix by attempting to access a restricted file via the /export endpoint; access should be denied.
Update SiYuan to version 3.5.10 or later. This version fixes the path traversal vulnerability in the /export endpoint.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-30869 is a critical vulnerability in SiYuan Kernel allowing attackers to read arbitrary files via the /export endpoint, potentially exposing sensitive data.
If you are using SiYuan Kernel versions prior to 3.5.10, you are vulnerable to this Path Traversal attack.
Upgrade SiYuan Kernel to version 3.5.10 or later to remediate the vulnerability. Consider WAF rules as a temporary workaround.
While no active exploitation has been confirmed, the vulnerability's ease of exploitation suggests a potential for future attacks.
Refer to the SiYuan project's official security advisories and release notes for details on this vulnerability and the fix.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your go.mod file and we'll tell you instantly if you're affected.