CyberRota Analysis
AI-GeneratedSiYuan 3.8.0 is vulnerable to a path traversal and sensitive file exposure issue in the RenderTemplate function, allowing authenticated attackers to access sensitive workspace files through the POST /api/template/render endpoint. This can lead to the disclosure of critical information, such as API tokens and cookie signing keys, potentially compromising the security of the application. Organizations using this version should prioritize upgrading to v3.8.1 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POST /api/template/render endpoint (kernel/api/template.go). The endpoint restricts the supplied path only to the workspace directory (util.IsAbsPathInWorkspace) but, unlike the file API's refuseToAccess() blocklist, applies no sensitive-path exclusion. This allows an authenticated attacker to read sensitive workspace files, including conf/conf.json, which contains the API token and cookie signing key. The issue is fixed in v3.8.1.