CVE-2026-100636: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in siyuan-note siyuan
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, enabling stored XSS or workspace defacement.
AI Analysis
Technical Summary
CVE-2026-100636 is a path traversal vulnerability in SiYuan note software prior to version 3.8.4. The vulnerability exists in the exportBrowserHTML endpoint, where an authenticated administrator can supply directory traversal sequences in the folder parameter to escape the export directory. This allows writing arbitrary HTML content to index.html files outside the workspace directory, including any kernel-writable location. The impact includes the possibility of stored XSS attacks or workspace defacement.
Potential Impact
An attacker with authenticated administrator privileges can exploit this vulnerability to write arbitrary HTML files outside the intended directory. This can lead to stored cross-site scripting (XSS) attacks or defacement of the user's workspace, compromising the integrity and security of the application environment.
Mitigation Recommendations
A fix is available in SiYuan version 3.8.4. Users should upgrade to version 3.8.4 or later to remediate this vulnerability. No additional mitigation steps are indicated.
CVE-2026-100636: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in siyuan-note siyuan
Description
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, enabling stored XSS or workspace defacement.
CVSS v4.0
Score 8.3high
Affected software
siyuan-note
siyuan
pkg:github/siyuan-note/siyuanRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-100636 is a path traversal vulnerability in SiYuan note software prior to version 3.8.4. The vulnerability exists in the exportBrowserHTML endpoint, where an authenticated administrator can supply directory traversal sequences in the folder parameter to escape the export directory. This allows writing arbitrary HTML content to index.html files outside the workspace directory, including any kernel-writable location. The impact includes the possibility of stored XSS attacks or workspace defacement.
Potential Impact
An attacker with authenticated administrator privileges can exploit this vulnerability to write arbitrary HTML files outside the intended directory. This can lead to stored cross-site scripting (XSS) attacks or defacement of the user's workspace, compromising the integrity and security of the application environment.
Mitigation Recommendations
A fix is available in SiYuan version 3.8.4. Users should upgrade to version 3.8.4 or later to remediate this vulnerability. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T02:32:35.658Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c9a5f7a7c5410652fd1f
Added to database: 09/26/2026, 13:33:25 UTC
Last enriched: 09/26/2026, 14:04:09 UTC
Last updated: 09/27/2026, 01:57:11 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.