{"id":"CVE-2026-54066","sourceIdentifier":"security-advisories@github.com","published":"2026-06-24T22:16:48.043","lastModified":"2026-10-25T23:10:00.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 (\"Path Traversal via Double URL Encoding\") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, default port 6808), an unauthenticated remote attacker can read arbitrary files inside WorkspaceDir — including conf/conf.json (which contains the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log — by double-URL-encoding .. segments. This vulnerability is fixed in 3.7.0."},{"lang":"es","value":"SiYuan es un sistema de gestión de conocimiento personal de código abierto. Antes de la versión 3.7.0, el parche para CVE-2026-41894 (’Salto de ruta mediante doble codificación URL’) saneaba la ruta /export/, pero la causa raíz idéntica permanece en la ruta /assets/path. En modo de publicación (punto final HTTP de solo lectura anónimo, puerto predeterminado 6808), un atacante remoto no autenticado puede leer archivos arbitrarios dentro de WorkspaceDir - incluyendo conf/conf.json (que contiene el hash SHA256 de AccessAuthCode, el token de API y las claves de sincronización), temp/siyuan.db, temp/blocktree.db y siyuan.log - mediante la doble codificación URL de segmentos ’..’. Esta vulnerabilidad se corrige en la versión 3.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"siyuan-note","product":"siyuan","versions":[{"version":"< 3.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-25T12:33:17.088814Z","id":"CVE-2026-54066","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-23"},{"lang":"en","value":"CWE-1188"}]}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4m3-mgmm-c664","source":"security-advisories@github.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4m3-mgmm-c664","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}