CVE-2026-59832 is a path traversal vulnerability (CWE-22) in SiYuan before version 3.7.1. The /snippets/*filepath route handler in kernel/server/serve.go joins a single-decoded request path with the snippets directory without checking for subpath containment or sensitive paths. This flaw allows an authenticated attacker to craft requests like /snippets/%2e%2e/%2e%2e/conf/conf.json to read files outside the snippets directory, including workspace secrets and the document database. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability is fixed in version 3.7.1.

An authenticated attacker can exploit this vulnerability to read sensitive files outside the intended snippets directory, including workspace secrets and the document database. This can lead to disclosure of confidential information, potentially compromising the confidentiality of the affected system. There is no indication of impact on integrity or availability.

Upgrade SiYuan to version 3.7.1 or later, where this path traversal vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor stating the issue is fixed in 3.7.1.