medium6.5
CVE-2026-109309
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler'…
Impact
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.
Affected products
| Product | Affected versions |
|---|---|
| SiYuan V3.7.0 | before 3.8.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.