Absolute Path Traversal Vulnerability in SiYuan Plugin HTTP Server
CVE-2026-109309

6.9MEDIUM

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109309?

An absolute path traversal vulnerability has been discovered in the SiYuan v3.7.0 plugin HTTP server. This flaw allows malicious actors to exploit a lack of validation on the ResponseFile.Path parameter. An attacker can craft a hostile kernel plugin that accesses any file within the SiYuan process's file system, including sensitive files such as the API token and configuration files. This vulnerability underscores the critical need for stringent input validation in plugin architectures to safeguard user data and application integrity.

Affected Version(s)

siyuan 3.7.0 < 3.8.6

siyuan 3.8.6

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://github.com/siyuan-note/siyuan/commit/c6494375ea40...
patch
https://www.vulncheck.com/advisories/siyuan-3.7.0-before-...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CyberSunil
.