{"id":"CVE-2026-40318","aliases":["GHSA-vw86-c94w-v3x4","GO-2026-5679"],"url":"https://o3.security/vulnerability/CVE-2026-40318","summary":"SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`","details":"## Summary\n\nThe endpoint `/api/av/removeUnusedAttributeView` is vulnerable to a **path traversal (CWE-22)** that allows an attacker to delete arbitrary `.json` files on the server.\n\nThe issue arises because user-controlled input (`id`) is directly used in filesystem path construction without validation or restriction.\n\n> Access to this endpoint (e.g., via a Reader-role or publish context) is considered a precondition and not part of the vulnerability. The root cause is unsafe path handling.\n\n---\n\n## Steps To Reproduce\n\n1. Ensure the target instance has the publish service enabled (or any valid access to the endpoint).\n2. Send the following request:\n\n```http\nPOST /api/av/removeUnusedAttributeView HTTP/1.1\nHost: <target>\nContent-Type: application/json\n\n{\n  \"id\": \"../../../conf/conf\"\n}\n```\n\n3. Observe that the request is accepted.\n4. The server resolves the path outside the intended directory and deletes the target file.\n\n---\n\n## Impact\n\nAn attacker can delete arbitrary `.json` files within the workspace directory.\n\nThis may lead to:\n\n* Deletion of global configuration files (e.g., `conf/conf.json`)\n* Loss of user data and application state\n* Corruption of workspace metadata\n* Persistent application instability or forced recovery\n\nThis represents a **server-side arbitrary file deletion primitive**, which can have severe impact depending on the targeted files.\n\n---\n\n## Technical Details\n\nThe vulnerable code constructs file paths as follows:\n\n```go\nfilepath.Join(util.DataDir, \"storage\", \"av\", id+\".json\")\n```\n\nBecause `id` is not validated, attackers can inject path traversal sequences such as `../` to escape the intended directory.\n\n### Example payloads\n\n* `../local` → `data/storage/local.json`\n* `../../storage/outline` → `data/storage/outline.json`\n* `../../../conf/conf` → `conf/conf.json`\n\nNo validation or restriction is applied to:\n\n* input format\n* path normalization\n* directory boundaries\n\n---\n\n## Root Cause\n\n* Untrusted user input (`id`) is directly used in filesystem path construction\n* No input validation or sanitization\n* No enforcement that the resolved path stays within the intended directory\n\n---\n\n## Remediation\n\n1. **Validate input strictly**\n\n   * Only allow valid Attribute View IDs\n   * Reject any input containing path traversal sequences\n\n2. **Enforce directory boundaries**\n\n```go\nbase := filepath.Join(util.DataDir, \"storage\", \"av\")\nabsPath := filepath.Join(base, id+\".json\")\n\nif !util.IsSubPath(base, absPath) {\n    return error\n}\n```\n\n3. **Normalize paths before use**\n\n   * Ensure canonical paths cannot escape the base directory\n\n4. **Add additional logical checks**\n\n   * Verify that the target object is valid and allowed to be deleted\n\n---","published":"2026-04-16T22:54:47.881Z","modified":"2026-08-12T03:51:08.335102570Z","cvss":{"score":8.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","fixedVersion":"3.6.40.0.0-20260407035653-2f416e5253f1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40318.json"},{"type":"ADVISORY","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vw86-c94w-v3x4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40318"},{"type":"PACKAGE","url":"https://github.com/siyuan-note/siyuan"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:08.335102570Z"}}