{"id":"EUVD-2026-42744","enisaUuid":"29f46ca1-b487-37d1-8b96-72ffd1a03721","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticated request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to read workspace secrets and the document database. This issue is fixed in versions 3.7.1.","datePublished":"Jul 9, 2026, 10:18:15 PM","dateUpdated":"Jul 10, 2026, 2:41:54 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-275h-v5h9-vr82\nhttps://github.com/siyuan-note/siyuan/commit/68cc0f537dfa4502496dfa794e71835421c25c09\nhttps://github.com/siyuan-note/siyuan/releases/tag/v3.7.1\n","aliases":"CVE-2026-59832\nGHSA-275h-v5h9-vr82\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"c36f04ef-4270-32fd-b87f-c0d1e31cb87f","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"\u003c 3.7.1"}],"enisaIdVendor":[{"id":"47befde2-41b7-39b3-a7f9-61432c9a41e7","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"9e7cae38-8e8a-3e89-9797-4748a7e3268b","vulnerability":{"id":"CVE-2026-59832","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticated request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to read workspace secrets and the document database. This issue is fixed in versions 3.7.1.","datePublished":"Jul 9, 2026, 10:18:15 PM","dateUpdated":"Jul 10, 2026, 2:41:54 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-275h-v5h9-vr82\nhttps://github.com/siyuan-note/siyuan/commit/68cc0f537dfa4502496dfa794e71835421c25c09\nhttps://github.com/siyuan-note/siyuan/releases/tag/v3.7.1\n","enisa_id":"EUVD-2026-42744\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Nov 7, 2026, 7:21:28 AM","vulnerabilityProduct":[{"id":"ade3e9e9-5b91-34a6-84ea-8aa966cc24d0","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"\u003c 3.7.1"}],"vulnerabilityVendor":[{"id":"d8a92a59-7103-3953-bc0f-4f03b7ea08bd","vendor":{"name":"siyuan-note"}}]}},{"id":"b7804bbf-2bce-329a-a01d-9a360880d6fe","vulnerability":{"id":"GHSA-275h-v5h9-vr82","description":"Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db","datePublished":"Sep 2, 2026, 2:17:44 PM","dateUpdated":"Sep 2, 2026, 2:17:44 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-275h-v5h9-vr82\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59832\nhttps://github.com/siyuan-note/siyuan/commit/68cc0f537dfa4502496dfa794e71835421c25c09\nhttps://github.com/siyuan-note/siyuan\nhttps://github.com/siyuan-note/siyuan/releases/tag/v3.7.1\n","enisa_id":"EUVD-2026-42744\n","aliases":"GHSA-275h-v5h9-vr82\nCVE-2026-59832\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}