Medium severity6.5NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026

CVE-2026-109309

Description

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.

Affected products

Siyuan Note/Siyuanreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: v3.7.0 before v3.8.6

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/commit/c6494375ea40ee973f430f0e85d50f1862a30d81nvd
github.com/siyuan-note/siyuan/security/advisories/GHSA-phmw-4rgv-r4xvnvd
www.vulncheck.com/advisories/siyuan-3.7.0-before-3.8.6-arbitrary-file-read-via-plugin-responsefile-pathnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000