CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to v3.8.2 are vulnerable to a path traversal flaw that allows attackers with reader access to exploit symlinks, enabling them to read files outside the designated workspace. This can lead to unauthorized data exposure, compromising the confidentiality of sensitive information. Organizations using affected versions should prioritize patching to mitigate potential risks associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.