CVE-2026-100638 describes a path traversal vulnerability in SiYuan note-taking software prior to version 3.8.4. The vulnerability exists in the setNotebookIcon endpoint, where authenticated administrators can supply directory traversal sequences in the notebook parameter. This enables them to escape the workspace data directory boundary and write files, such as conf.json, to arbitrary locations accessible by the kernel process. This could lead to unauthorized file creation or modification outside the intended workspace.

An attacker with authenticated administrator privileges can exploit this vulnerability to write files outside the designated workspace directory. This could allow unauthorized modification or creation of configuration files (e.g., conf.json) in arbitrary locations accessible by the kernel process, potentially impacting system integrity and security. The CVSS 4.0 score is 8.3 (high severity), reflecting the network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Users should upgrade SiYuan to version 3.8.4 or later where this vulnerability is fixed. Since the vulnerability affects versions before 3.8.4, applying the official update will remediate the issue. No other mitigation steps are indicated by the vendor advisory.