CVE-2026-109309

Name of the Vulnerable Software and Affected Versions SiYuan versions 3.7.0 through 3.8.5

Description An absolute path traversal issue exists in the kernel's private plugin HTTP server. The server passes the ResponseFile.Path of a kernel plugin handler to the Context.File function without proper validation. This allows an attacker who provides a malicious kernel plugin to specify an absolute path and read any file accessible by the SiYuan process, such as the API token and conf.json.

Recommendations Update SiYuan to version 3.8.6 or later.