Kernel: Duplicate Advisory: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

SiYuan versions prior to v3.7.3 fail to properly validate the avID parameter in attribute-view read endpoints, enabling attackers to craft traversal paths that escape the storage directory. This vulnerability allows users with RoleReader permissions or anonymous clients (when publish authentication is disabled) to access JSON files outside the attribute-view directory, leading to disclosure of database content beyond the intended scope. The advisory is a duplicate and withdrawn in favor of GHSA-7hm9-v7vf-7g4w. The vulnerability is classified as CWE-22 (Path Traversal).

An attacker with RoleReader permissions or an anonymous user (if publish authentication is disabled) can read JSON files outside the designated attribute-view directory. This results in unauthorized disclosure of sensitive database content across different scopes. The vulnerability does not impact integrity or availability but has high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory GHSA-7hm9-v7vf-7g4w for current remediation guidance. Until a fix is applied, restrict access to authenticated users with appropriate permissions and ensure publish authentication is enabled to prevent anonymous access.