HIGH 7.7 GitHub
CVE-2026-59832
Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db
Reporter: Cavan Loughran, Celvex Group Inc.
Summary
-------
The /snippets/*filepath route handler serveSnippets in kernel/server/serve.go performs a bare filepath.Join(util.SnippetsPath, filePath) on the single-decoded c.Request.URL.Path and serves the result with c.File(), with NO IsSubPath containment and NO IsSensitivePath denylist - unlike the sibling /export/ (serveExport) and /appearance/ (serveAppearance) handlers, which both carry IsSubPath, and unlike /assets/ (serveAssets), whose trav
Affected Products
- go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260704035520-68cc0f537dfa
References
- https://github.com/advisories/GHSA-275h-v5h9-vr82
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-275h-v5h9-vr82
- https://nvd.nist.gov/vuln/detail/CVE-2026-59832
- https://github.com/siyuan-note/siyuan/commit/68cc0f537dfa4502496dfa794e71835421c25c09
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-09-02 via GitHub. Affected: go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260704035520-68cc0f537dfa.
vulnfeed aggregates 11639 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.