CVE-2026-77086: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in siyuan-note siyuan

SiYuan versions prior to 3.7.4 do not properly validate the packageName parameter in the Bazaar install and uninstall API endpoints. This improper limitation of pathname to a restricted directory (path traversal) vulnerability allows authenticated administrators to perform directory traversal sequences. Exploitation can lead to arbitrary file write operations during install and recursive directory deletion during uninstall, by manipulating the packageName parameter with crafted directory traversal sequences.

An attacker with authenticated administrator access can leverage this vulnerability to write arbitrary files to any location on the system or delete directories recursively. This can lead to system compromise, data loss, or disruption of service. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity with high impact on confidentiality, integrity, and availability.

A fixed version 3.7.4 or later addresses this vulnerability. Users should upgrade siyuan-note to version 3.7.4 or newer to remediate this issue. Since the vulnerability requires authenticated administrator access, restricting admin privileges and monitoring for suspicious activity can reduce risk until the upgrade is applied.