CVE-2026-59832 is a path traversal vulnerability (CWE-22) in SiYuan before version 3.7.1. The /snippets/*filepath route handler in kernel/server/serve.go joins a single-decoded request path with the snippets directory without checking for subpath containment or sensitive paths. This flaw allows an authenticated attacker to craft requests like /snippets/%2e%2e/%2e%2e/conf/conf.json to read files outside the snippets directory, including workspace secrets and the document database. The vulnerability has a CVSS 3.1 score of 7.7 (High) with network attack vector, low attack complexity, required privileges, no user interaction, and impacts confidentiality with a scope change. The issue is resolved in SiYuan version 3.7.1.

An authenticated attacker can exploit this vulnerability to read sensitive files outside the intended snippets directory, including workspace secrets and the document database. This leads to a confidentiality breach with potentially significant exposure of sensitive user data. There is no impact on integrity or availability reported.

Upgrade SiYuan to version 3.7.1 or later, where this path traversal vulnerability is fixed. Since no official patch or temporary fix is explicitly stated beyond this version update, applying this upgrade is the recommended remediation. Patch status is not explicitly confirmed beyond the fix in 3.7.1; verify with the vendor advisory for the latest guidance.