CVE-2026-69086

Executive Summary

CVE-2026-69086 is an unauthenticated/authenticated path traversal vulnerability (CWE-22) affecting SiYuan, a popular self-hosted note-taking and knowledge management platform, in all versions prior to v3.7.3. The flaw resides in attribute-view read endpoints where the avID parameter is not properly validated, enabling an attacker to escape the storage directory and read arbitrary JSON files containing cross-scope database content. With a CVSS score of 7.7 (High) and a public PoC available, this vulnerability poses a significant information disclosure risk for enterprises self-hosting SiYuan instances, particularly those with publish authentication disabled. The vendor has not released an official patch, and the affected version list is empty, making immediate mitigations critical for exposed deployments.

Technical Analysis

The vulnerability is a classic path traversal flaw (CWE-22) embedded within SiYuan's attribute-view read endpoints. Specifically, the avID (attribute view ID) parameter is passed to file-reading routines without adequate sanitization or canonicalization. The affected code paths are all branches within the attribute-view read function, meaning both main and error-handling branches fail to validate the parameter's structure. An attacker can supply a crafted avID value containing traversal sequences such as ../ or absolute path components to escape the intended storage/attribute-view directory. Once outside this sandbox, the application's file reader will follow the traversed path and return the contents of any readable JSON file on the host filesystem within the application's user context. The vulnerability is particularly severe because the affected endpoints do not strictly require elevated privileges: authenticated users with only RoleReader permissions (the minimal read-only role) can exploit it, and when publish authentication is disabled (a common misconfiguration in public-facing deployments), the endpoint becomes completely anonymous. This broadens the attack surface from authenticated insiders to any network-accessible client. The disclosure impact is categorized as high according to the CVSS v3.1 vector (C:H), and the scope is changed (S:C), meaning the vulnerable component is not the only component affected — data outside the application's intended security boundary is compromised. The lack of integrity or availability impact suggests that an attacker can only read data, not modify or destroy it, but the sensitivity of JSON files (often containing database dumps, configuration secrets, or user notes) amplifies the business risk. Notably, the vendor has not yet acknowledged the issue in a formal advisory, and no patch is available, leaving all SiYuan versions below v3.7.3 in a permanently exposed state until remediation.

Exploitation Scenarios

Step-by-step attack chain for CVE-2026-69086, assuming a self-hosted SiYuan instance with publish authentication disabled:

1. Reconnaissance: The attacker identifies a target SiYuan instance via Shodan or other internet-wide scans using the dorks listed in METADATA. They confirm the version by fetching POST /api/system/getVersion (unauthenticated) or by inspecting the HTML source for the SiYuan identifier. Version ≤ 3.7.2 confirms vulnerability eligibility.

2. Endpoint Discovery: The attacker enumerates API endpoints, specifically focusing on attribute-view read routes. The key endpoint is POST /api/attr/readAttrView (or equivalent, depending on the build), which accepts a JSON body. The attacker crafts a minimal request: {"avID": "vulnerable_id"}.

3. Weaponization: The attacker replaces avID with a traversal payload. Since the flaw exists on all code branches, the attacker can use either a relative path (../../../etc/passwd — though the app only reads JSON files, so they target known JSON paths like /opt/SiYuan/conf/config.json) or an absolute path (/etc/siyuan/conf/config.json). The payload is URL-encoded or JSON-escaped to bypass any naive filtering: e.g., %2e%2e%2f for ../, or using absolute paths which the validator may not block. A successful payload mimics: {"avID": "../../../../../../etc/siyuan/data/database.json"}.

4. Execution: The attacker sends the POST request to the target. The server-side file reader resolves the traversed path, reads the specified JSON file, and returns its contents in the HTTP response body as part of the attribute-view data structure. Since publish authentication is disabled, no login is required; the request is processed as an anonymous client.

5. Post-Exploitation: The attacker now has access to arbitrary JSON files readable by the SiYuan process. They target high-value files: the main database dump (data.json — containing all user notes, attachments metadata, and potentially embedded secrets), configuration files (conf/config.json — containing API keys, SMTP credentials, or database connection strings), or OS-level JSON files in the same directory tree. This information is exfiltrated and used for lateral movement, credential stuffing, or blackmail. Even with RoleReader-only access (when authenticated), the attacker can pivot to reading all users' notes, breaking data confidentiality across the entire instance.

Impact Assessment

The CVSS v3.1 score of 7.7 (High) reflects a network-exploitable vulnerability with low attack complexity, low privilege requirement (or none when publish auth is disabled), no user interaction, and a changed scope with high confidentiality impact. The business impact is severe for organizations relying on SiYuan for internal documentation, project management, or knowledge bases. The blast radius extends beyond the application's attribute-view directory to any JSON file accessible by the service account — this includes configuration files, database snapshots, and potentially cross-tenant data if multiple teams share the instance. For enterprises with sensitive IP in notes (e.g., architecture diagrams, credentials, client data), a compromise leads to regulatory fines (GDPR/CCPA), reputational damage, and loss of competitive advantage. The "scope changed" characteristic means the attacker is not limited by the application's sandbox; they can read files on the host OS, potentially exposing TLS private keys, application secrets, or even other applications' data if they share the same user context. The absence of integrity/availability impact slightly reduces the immediate operational disruption, but the data leakage alone qualifies as a critical incident. Affected systems include all SiYuan deployments listed in public registries (GitHub, Docker Hub) — the lack of official version enumeration means the entire historical user base is at risk, and with the public PoC, real-world exploitation is imminent.

Detection Guidance

Sigma Rule

title: SiYuan Attribute-View avID Path Traversal Attempt
id: 3f4a8c92-6b7d-4e5a-9c3f-1d2e4a5b6c7d
status: experimental
description: Detects path traversal attempts targeting the avID parameter in SiYuan attribute-view read endpoints.
author: ValtersIT Threat Intel
date: 2026/09/15
logsource:
  category: webserver
  product: nginx
  service: http
detection:
  selection:
    http.method: POST
    http.url|contains:
      - '/api/attr/readAttrView'
      - '/api/attribute/view/read'
    http.body|contains|all:
      - 'avID'
    http.body|contains|any:
      - '..%2f'
      - '..%2F'
      - '%2e%2e%2f'
      - '..%5c'
      - '/etc/'
      - '/var/'
      - '/opt/'
  condition: selection
fields:
  - client.ip
  - http.user_agent
  - http.body
falsepositives:
  - Legitimate use of absolute paths in unsanitized internal scripts (rare)
level: high

YARA Rule

rule SiYuan_avID_Path_Traversal_Malware
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects malicious payloads exploiting CVE-2026-69086 path traversal in SiYuan"
        date = "2026-09-15"
        cve = "CVE-2026-69086"
        version = "1.0"
    strings:
        $trigger = "avID" ascii wide
        $traversal1 = "../" ascii wide
        $traversal2 = "..%2f" ascii wide
        $traversal3 = "%2e%2e%2f" ascii wide
        $endpoint = "/api/attr/readAttrView" ascii wide
        $json_ext = ".json" ascii wide
        $absolute_path = "/etc/" ascii wide
        $absolute_path2 = "/opt/" ascii wide
        $absolute_path3 = "/var/" ascii wide
    condition:
        $trigger and $endpoint and 1 of ($traversal*) and 1 of ($absolute_path*)
        or ($trigger and $endpoint and $json_ext and 2 of ($traversal*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-69086 SiYuan Attribute-View Path Traversal Exploit Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/attr/readAttrView"; http.request_body; pcre:"/(?:\.\.\/|%2e%2e%2f|%2e%2e\/)[^"]*\.json/Ui"; classtype:attempted-admin; sid:70069086; rev:1; metadata:created_at 2026_09_15, cve CVE-2026-69086;)

Elastic Detection

any where process.name == "siyuan" and event.action in ("read","open") and file.path like "*..*" and file.extension == ".json" and process.args like "*avID*" and file.path not like "*siyuan*attribute-view*" or (network.protocol == "http" and http.request.method == "POST" and url.path like "*attr*view*read*" and request.body like "*avID*" and (request.body like "*..%2f*" or request.body like "*%2e%2e*" or request.body like "*..\\*"))

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path IN ("/api/attr/readAttrView", "/api/attribute/view/read")
| regex _raw="(\.\.%2f|%2e%2e%2f|\.\./)"
| regex form_data="avID=.*(etc|var|opt)"
| table _time, src_ip, user, uri, form_data, status
| stats count by src_ip, uri, form_data
| sort - count

Wazuh OSSEC Rule

<group name="siyuan,">
  <rule id="690860" level="12">
    <decoded>\d+\.\d+\.\d+\.\d+.*POST.*/api/attr/readAttrView.*</decoded>
    <match>\.\.%2f|%2e%2e%2f|\.\./</match>
    <description>SiYuan CVE-2026-69086 path traversal attempt detected in attribute-view read request.</description>
    <group>attack.path_traversal,cve,cve-2026-69086</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <alert>4</alert>
  </rule>
  <rule id="690861" level="15">
    <if_sid>690860</if_sid>
    <time>1m</time>
    <match>\.\./.*\.json</match>
    <description>Multiple SiYuan traversal attempts - potential exploitation in progress.</description>
    <group>attack.recon,cve-2026-69086</group>
    <alert>5</alert>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no official patch or vendor advisory exists, and affected versions are not enumerated. Until a fix is released, follow this prioritized plan:

1. Immediate Mitigations (do these now):

   • Disable publish authentication by setting publish.auth = true in SiYuan's config.json, forcing authentication for all read endpoints (this blocks anonymous exploitation).
   • If publishing is not required, disable the publish server entirely: publish.enable = false in the same config.
   • Apply network-level controls: restrict access to the SiYuan instance to trusted IP ranges via firewall rules or reverse proxy ACLs. Do not expose it to the internet unless absolutely necessary.
   • Deploy a Web Application Firewall (WAF) with rules to block traversal patterns in POST bodies (e.g., block .. sequences, %2e%2e, absolute paths starting with /etc/, /var/, /opt/).
   • Audit existing deployments for evidence of exploitation: search web server logs for readAttrView requests containing .. or unexpected avID values; review file system for unauthorized JSON file accesses.

2. Patch/Upgrade Steps (when available):

   • Monitor the official SiYuan repository (https://github.com/siyuan-note/siyuan) and its release notes for v3.7.3 or later. The first fixed version is indicated as v3.7.3; upgrade to this version or newer once it is confirmed to address the CVE.
   • Until then, apply the community-supplied patch if one emerges: modify the affected code to canonicalize avID using filepath.Clean() and validate that the resolved path stays within the storage/attribute-view directory using strings.HasPrefix.
   • After upgrading, re-test the endpoint with traversal payloads to confirm the fix.

3. Long-Term Hardening:

   • Run SiYuan as a dedicated, low-privilege user (e.g., siyuan service account) with read access restricted to only the SiYuan data directory. Avoid running as root or with broad filesystem reads.
   • Implement a containerized deployment (Docker) with read-only root filesystem and bind-mounted only the /opt/siyuan data directory.
   • Enable comprehensive logging on the web server and application, and integrate with SIEM (Splunk, Elastic) for real-time traversal detection.
   • Conduct regular vulnerability scans using tools like Nuclei with the public PoC to validate patch status.
   • Subscribe to SiYuan security advisories and third-party CVE feeds to receive immediate notification of patch releases.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69086
2. SiYuan Official Repository: https://github.com/siyuan-note/siyuan (watch for v3.7.3 release notes)
3. FIRST.org EPSS (pending score): https://www.first.org/epss/
4. MITRE ATT&CK Technique: https://attack.mitre.org/techniques/T1190/
5. Public PoC (hackerone/exploit-db reference — verify status): https://exploit-db.com/exploits/69086 (verify manually)

Threat Actor Activity: As of this report date, no known threat actors have been publicly attributed to exploiting CVE-2026-69086 in the wild. However, the public availability of a PoC combined with the trivial exploitation and the high value of note-taking data (which often contains credentials, tokens, and sensitive corporate information) makes mass exploitation highly likely within 2-4 weeks. Security teams should treat any exposed SiYuan instance as a critical risk and apply the immediate mitigations above without delay.