https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 09:09:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-293129 EUVD-2026-293129 https://cve.radiocsirt.org/vuln/euvd-2026-293129 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41894 <p>SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did not address the root cause — a redundant url.PathUnescape() call in serveExport(). An authenticated attacker can use double URL encoding (%252e%252e) to traverse directories and read arbitrary workspace files including the full SQLite database (siyuan.db), kernel log, and all user documents. This vulnerability is fixed in 3.6.5.</p> <p>SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did not address the root cause — a redundant url.PathUnescape() call in serveExport(). An authenticated attacker can use double URL encoding (%252e%252e) to traverse directories and read arbitrary workspace files including the full SQLite database (siyuan.db), kernel log, and all user documents. This vulnerability is fixed in 3.6.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41894 https://cve.radiocsirt.org/vuln/ghsa-hjh7-r5w8-5872 <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary The fix for CVE-2026-30869 in SiYuan v3.5.10 only added a denylist check (`IsSensitivePath`) but did not address the root cause — a redundant `url.PathUnescape()` call in `serveExport()`. An authenticated attacker can use double URL encoding (`%252e%252e`) to traverse directories and read arbitrary workspace files including the full SQLite database (`siyuan.db`), kernel log, and all user documents.</p> <p>### Details In `kernel/server/serve.go`, the `serveExport()` function (line 314-320) processes file paths as follows:</p> <p>```go filePath := strings.TrimPrefix(c.Request.URL.Path, &#34;/export/&#34;) decodedPath, err := url.PathUnescape(filePath) // second decode fullPath := filepath.Join(exportBaseDir, decodedPath) ```</p> <p>Go&#39;s HTTP server already decodes percent-encoded characters once during request parsing. The additional `url.PathUnescape()` call creates a double-decode vulnerability:</p> <p>1. Attacker sends: `GET /export/%252e%252e/siyuan.db` 2. Go HTTP decodes `%25` → `%`, result: `URL.Path = /export/%2e%2e/siyuan.db` 3. Go&#39;s path cleaner sees `%2e%2e` as literal characters (not `..`), no redirect occurs 4. `url.PathUnescape(&#34;%2e%2e&#34;)` decodes to `..` 5. `filepath.Join(exportBaseDir, &#34;../siyuan.db&#34;)` resolves to `&lt;workspace&gt;/temp/siyuan.db`</p> <p>The CVE-2026-30869 fix added `IsSensitivePath()` which blocks `&lt;workspace&gt;/conf/` and OS-level paths (`/etc`, `/root`, etc.). However, it does NOT block: - `&lt;workspace&gt;/temp/siyuan.db` — full document database - `&lt;workspace&gt;/temp/blocktree…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary The fix for CVE-2026-30869 in SiYuan v3.5.10 only added a denylist check (`IsSensitivePath`) but did not address the root cause — a redundant `url.PathUnescape()` call in `serveExport()`. An authenticated attacker can use double URL encoding (`%252e%252e`) to traverse directories and read arbitrary workspace files including the full SQLite database (`siyuan.db`), kernel log, and all user documents.</p> <p>### Details In `kernel/server/serve.go`, the `serveExport()` function (line 314-320) processes file paths as follows:</p> <p>```go filePath := strings.TrimPrefix(c.Request.URL.Path, &#34;/export/&#34;) decodedPath, err := url.PathUnescape(filePath) // second decode fullPath := filepath.Join(exportBaseDir, decodedPath) ```</p> <p>Go&#39;s HTTP server already decodes percent-encoded characters once during request parsing. The additional `url.PathUnescape()` call creates a double-decode vulnerability:</p> <p>1. Attacker sends: `GET /export/%252e%252e/siyuan.db` 2. Go HTTP decodes `%25` → `%`, result: `URL.Path = /export/%2e%2e/siyuan.db` 3. Go&#39;s path cleaner sees `%2e%2e` as literal characters (not `..`), no redirect occurs 4. `url.PathUnescape(&#34;%2e%2e&#34;)` decodes to `..` 5. `filepath.Join(exportBaseDir, &#34;../siyuan.db&#34;)` resolves to `&lt;workspace&gt;/temp/siyuan.db`</p> <p>The CVE-2026-30869 fix added `IsSensitivePath()` which blocks `&lt;workspace&gt;/conf/` and OS-level paths (`/etc`, `/root`, etc.). However, it does NOT block: - `&lt;workspace&gt;/temp/siyuan.db` — full document database - `&lt;workspace&gt;/temp/blocktree…</p> https://cve.radiocsirt.org/vuln/ghsa-hjh7-r5w8-5872