CVE-2026-65607 describes a path traversal vulnerability in SiYuan note-taking software prior to version 3.7.2. The vulnerability exists in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go), where the raw, percent-decoded request path is joined with the temporary directory path and served without IsSubPath or IsSensitivePath checks. This allows an authenticated attacker to craft requests with percent-encoded traversal sequences (e.g., %2e%2e for '..') to read arbitrary files outside the intended directory, including sensitive system and application files. The vulnerability bypasses protections added in a previous hardening effort (GHSA-6865-qjcf-286f).

An authenticated attacker can read arbitrary files on the system running SiYuan, including sensitive files such as /etc/passwd, SSH private keys, and SiYuan workspace database and log files. This exposure can lead to information disclosure and potential further compromise of the affected system. The vulnerability does not require user interaction and has a low attack complexity but requires authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before v3.7.2, upgrading to version 3.7.2 or later is likely to address the issue. Until an official fix is confirmed, restrict access to the affected endpoint to trusted users and monitor for suspicious activity involving path traversal patterns in requests.