CVE-2026-109309

6.5 MEDIUMpublic exploit available

Published 2026-10-12 · Updated 2026-10-13

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses

CWE-22

Public exploit & PoC references

https://github.com/siyuan-note/siyuan/commit/c6494375ea40ee973f430f0e85d50f1862a30d81
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-phmw-4rgv-r4xv

All references

https://github.com/siyuan-note/siyuan/commit/c6494375ea40ee973f430f0e85d50f1862a30d81
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-phmw-4rgv-r4xv
https://www.vulncheck.com/advisories/siyuan-3.7.0-before-3.8.6-arbitrary-file-read-via-plugin-responsefile-path

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2014-125130PoC
HIGHCVE-2017-20284
HIGHCVE-2021-48011PoC
HIGHCVE-2023-54403PoC
MEDIUMCVE-2024-58386PoC
HIGHCVE-2024-58387PoC
HIGHCVE-2024-58388PoC
MEDIUMCVE-2025-1280

Related by shared AI tags and CWE weakness class. Browse the full archive.