Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

GHSA-gw25-m53r-qh88

MEDIUMFix: siyuan-note/siyuan@b763d78

GHSA-gw25-m53r-qh88 is a medium-severity (CVSS 6.5) Path Traversal vulnerability in github.com/siyuan-note/siyuan/kernel. O3 Security confirms whether GHSA-gw25-m53r-qh88 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

Also known asCVE-2026-65607
Published
Sep 3, 2026
Updated
Sep 3, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Sep 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐹github.com/siyuan-note/siyuan/kernel

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

SiYuan's /export/ file handler was hardened against export disclosure (issue #12213) by adding an IsSubPath(exportBaseDir, fullPath) check and an IsSensitivePath() check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit branch:

if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") {
    c.File(filepath.Join(util.TempDir, c.Request.URL.Path))
    return
}

This branch joins the broader util.TempDir with the raw, percent-decoded request path and serves it with neither IsSubPath nor IsSensitivePath. An authenticated request to /export/temp/%2e%2e/.../etc/passwd traverses out of TempDir and reads arbitrary files - exactly the sensitive-file disclosure the patch intended to prevent. Present in the latest master.

Affected

  • From commit bb481e1 (the hardening) through the latest master.
  • Requires SiYuan access authorization (model.CheckAuth) - but the patch's stated goal is to deny sensitive-file export even to authorized callers.

Root cause

kernel/server/serve.go serveExport(): the main branch has IsSubPath + IsSensitivePath; the /export/temp/ short-circuit branch (above it) has neither and uses util.TempDir as its root. c.Request.URL.Path is percent-decoded by net/http, so %2e%2e becomes .. and filepath.Join collapses it.

Incomplete-fix lineage

  • Export disclosure (issue #12213; CVE-2026-30869) -> fix bb481e1 / d68bd5a (GHSA-6865-qjcf-286f): guards on the main branch + IsSensitivePath extended to *.db/*.log.
  • Follow-up CVE-2026-41894 (GHSA-hjh7-r5w8-5872) in the same /export path family.
  • The /export/temp/ short-circuit branch was never covered by the guards (this report).

Proof of concept (benign)

  1. Authenticate (access auth code).
  2. GET /export/<sensitive> (main branch) -> 401/403 (guards work).
  3. GET /export/temp/%2e%2e/%2e%2e/.../tmp/<planted-marker> (or /etc/hostname) -> 200 + file content, demonstrating the unguarded traversal. The PoC reads only a planted marker / /etc/hostname; no credentials.

Impact

Authenticated arbitrary file read bypassing the sensitive-file protection: /etc/passwd, ~/.ssh/*, SiYuan *.db workspace data, *.log.

Remediation

  • Apply IsSubPath + IsSensitivePath to the /export/temp/ branch (or restrict its root to TempDir/temp with an IsSubPath check).
  • filepath.Clean the request path and reject ...
  • Merge both branches into one guarded file-serving function.

References

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/siyuan-note/siyuan/kernelall versions0.0.0-20260510110132-b763d787d1f2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/siyuan-note/siyuan/kernel. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update github.com/siyuan-note/siyuan/kernel to 0.0.0-20260510110132-b763d787d1f2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-gw25-m53r-qh88 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether GHSA-gw25-m53r-qh88 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-gw25-m53r-qh88. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary SiYuan's `/export/` file handler was hardened against export disclosure (issue #12213) by adding an `IsSubPath(exportBaseDir, fullPath)` check and an `IsSensitivePath()` check in commit `bb481e1`. These guards were added only to the main branch of the handler. The handler begins with a short-circuit branch: ```go if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") { c.File(filepath.Join(util.TempDir, c.Request.URL.Path)) return } ``` This branch joins the **broader** `util.TempDir` with the raw, percent-decoded request path and serves it with **neither** `IsSubPath` **
O3 Security · Impact-Aware SCA

Is GHSA-gw25-m53r-qh88 in your dependencies?

O3 detects GHSA-gw25-m53r-qh88 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works
GHSA-gw25-m53r-qh88: kernel (Medium 6.5) | O3 Security