Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100636— SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder

Quick assessment

Affected
siyuan-note siyuan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

思源笔记（SiYuan）在 v3.8.4 之前的版本中，其 接口存在路径遍历漏洞，允许已认证的管理员将任意 HTML 内容写入工作区目录之外的 文件。攻击者可以通过构造包含目录遍历序列的 参数，突破导出目录的限制，覆写任意具有内核写入权限位置中的 文件，从而实施存储型跨站脚本攻击（Stored XSS）或篡改工作区界面。

CVSS 7.6 · High EPSS 0.54% · P43
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100636

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, enabling stored XSS or workspace defacement.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
siyuan-note siyuan 0 ~ 3.8.4 -

II. Public POCs for CVE-2026-100636

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100636

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100636 (1)

Other References for CVE-2026-100636 (1)

Same Patch Batch · siyuan-note · 2026-09-26 · 14 CVEs total

CVE-2026-100639 8.8 HIGH SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL
CVE-2026-100646 8.1 HIGH SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header
CVE-2026-100645 8.0 HIGH SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban
CVE-2026-100643 8.0 HIGH SiYuan before v3.8.4 Stored XSS via Attribute View textarea
CVE-2026-100641 8.0 HIGH SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
CVE-2026-100642 7.6 HIGH SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth
CVE-2026-100637 7.6 HIGH SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID
CVE-2026-100638 7.6 HIGH SiYuan before v3.8.4 Path Traversal via setNotebookIcon
CVE-2026-100644 7.5 HIGH SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath
CVE-2026-100633 6.5 MEDIUM SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations
CVE-2026-100635 5.9 MEDIUM SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
CVE-2026-100634 4.7 MEDIUM SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows
CVE-2026-100640 4.7 MEDIUM SiYuan before v3.8.4 Clipboard Data Disclosure via IPC

IV. Related Vulnerabilities

Same product: siyuan
Same vendor: siyuan-note
Same weakness: CWE-22

V. Comments for CVE-2026-100636

No comments yet

Leave a comment