CVE-2026-65607

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2

Description An authenticated attacker can exploit a path traversal issue in the /export/temp/ endpoint within the serveExport handler (located in kernel/server/serve.go). The vulnerability exists because the short-circuit branch of this handler joins the percent-decoded request path with util.TempDir without performing IsSubPath or IsSensitivePath security checks. By using percent-encoded traversal sequences, such as %2e%2e (which decodes to ..), an attacker can bypass sensitive-file protections to read arbitrary files outside the intended directory, including system files like /etc/passwd, SSH keys, and workspace .db and .log files.

Recommendations Update SiYuan to version 3.7.2 or later.