SiYuan Note Incomplete IsSensitivePath Path Traversal Leads to Sensitive Credential Leakage

Vulnerability Overview Vulnerability Name: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles ( , , , , , ) into the workspace Vulnerability Description: Vulnerability Type: Path Traversal Vulnerability Vulnerability Location: endpoint Root Cause: The function fails to correctly check user-supplied absolute source paths, allowing sensitive files (such as , , , , , ) to be copied into the workspace. Scope of Impact Affected Versions: /home/siyuan/.git-credentials printf "machine api.example.com\n login admin\n password NETRC_SECRET_PW_42\n" > /home/siyuan/.netrc echo "PRIVATE_KEY_CONTROL_SHOULD_BE_BLOCKED" > /home/siyuan/.ssh/id_rsa echo "1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:1000:10

Goal Reached Thanks to every supporter — we hit 100%!

SiYuan Note Incomplete IsSensitivePath Path Traversal Leads to Sensitive Credential Leakage

More from this source