CVE-2026-77086

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description Authenticated administrators can perform path traversal by using directory traversal sequences in the Bazaar install and uninstall endpoints. By providing crafted values for the packageName parameter, an attacker with administrative privileges can write arbitrary files to any location during install operations or recursively delete directories during uninstall operations.

Recommendations Update to version 3.7.4 or later. Avoid using the packageName parameter in the Bazaar install and uninstall endpoints until the update is applied.