CVE-2026-59854 Details
Description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts attacker-supplied absolute source paths and relies on util.IsSensitivePath in kernel/util/path.go, whose denylist misses common home-directory credential files such as .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg, allowing an authenticated administrator or API-token user to copy those files into the workspace and exfiltrate them through the file API. This issue is fixed in versions 3.7.1-alpha.2 and 3.7.1.
A vulnerability in SiYuan's global copy files API endpoint allows authenticated users to exfiltrate sensitive credential files from their home directory into the SiYuan workspace. This issue affects SiYuan versions prior to 3.7.1 and arises because the application improperly validates absolute file paths. The 'IsSensitivePath' utility, responsible for denying access to sensitive files, has an incomplete denylist that overlooks common credential dotfiles such as '.git-credentials', '.netrc', '.pgpass', '.kube/config', '.docker/config.json', and '.gnupg'. As a result, an authenticated administrator or API-token user can exploit this oversight to copy these files into the workspace and retrieve them via the file API.
Users can update to SiYuan versions 3.7.1-alpha.2 or 3.7.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/commit/914c5180a88d17f6d38716a56483327b367ef55f | [email protected] | Source CodeVendor |
| https://github.com/siyuan-note/siyuan/commit/b54fee401799d987d2fd2888220938ad599b8c5e | [email protected] | Source CodeVendor |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1 | [email protected] | Release NotesVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vmm8-3ccv-ppvw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | <= 3.6.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |