MajorCritical vulnerability

CVE-2026-100637 (CVSS 8.3)

NVD · officialPublished Sep 26, 2026Risk 37/100

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON files in pre-existing kernel-writable directories outside workspace boundaries.

Technical details

CVSS

8.3

AV:NetworkAC:LowPR:HighUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source