CyberRota Analysis
AI-GeneratedThe vulnerability affects SiYuan versions prior to 3.7.1, allowing authenticated users to exploit the /snippets/*filepath route handler to access sensitive files, including workspace secrets and the document database, through path traversal attacks. This poses a significant risk to data confidentiality and integrity. Organizations using SiYuan should prioritize upgrading to version 3.7.1 or later to mitigate this high-severity issue.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticated request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to read workspace secrets and the document database. This issue is fixed in versions 3.7.1.