Threats tagged 'ghsa-fgx6-mcm3-mrhr'

SiYuan versions 3.7.0 up to but not including 3.8.10 on Windows contain a path traversal vulnerability in the kernel/util/webfetch.go component. This flaw allows attackers to write files outside the intended import directory by using backslash-encoded sequences in filenames. Specifically, attackers controlling URLs fetched by the MCP web_fetch or http_request tools can exploit %5C-encoded ..\ sequences to write arbitrary response data to directories above the temp/import folder that are writable by the SiYuan user.