GHSA-gw25-m53r-qh88: Path Traversal Bypass in SiYuan Notebook via /export/temp/ Short-Circuit Branch

The Go-based backend application of SiYuan Notebook (github.com/siyuan-note/siyuan/kernel) exposes a suite of management endpoints, including the /export/ routing group. This group is responsible for packaging and serving generated documents, database snapshots, and workspace backups to users. Security controls are established on this route to ensure file retrieval is confined within strict physical directory bounds.

In previous development cycles, the product was hardened against unauthorized directory traversal (such as under advisory GHSA-6865-qjcf-286f). This patch integrated protective measures like IsSubPath and IsSensitivePath checks. However, these checks were only applied to the primary handling sequence within the /export/ routing branch.

To facilitate the immediate delivery of transient runtime assets, the developer subsequently implemented a short-circuit branch at the very beginning of the /export/ route handler. This branch matches requests under the /export/temp/ path prefix. Because this branch executes prior to, and independent of, the main logic path, it bypasses both the directory limit verification and the sensitive file extraction protections, exposing a raw path-traversal entry point.

The technical flaw resides within the serveExport() function of kernel/server/serve.go. When an HTTP request is received, the routing mechanism processes the request through the Go Standard Library and the Gin Web Framework. During this processing, percent-encoded components in the path (such as %2e%2e) are fully decoded to their raw characters (..) prior to route matching.

The application evaluates the incoming request using a prefix conditional check: strings.HasPrefix(c.Request.URL.Path, "/export/temp/"). If a client submits a request to /export/temp/%2e%2e/%2e%2e/etc/passwd, the router decodes it to /export/temp/../../etc/passwd. Because this decoded string still matches the prefix /export/temp/, the conditional statement evaluates to true.

Once inside this short-circuit block, the application attempts to resolve the file path utilizing filepath.Join(util.TempDir, c.Request.URL.Path). In the Go runtime, filepath.Join inherently executes filepath.Clean on the input string. This function recursively resolves parent directory selectors, moving the target path out of the intended root directory. Because the application then passes the resolved path directly to c.File() without performing any logical validation against parent directory markers or canonical root directory containment, an arbitrary file read is completed.

An examination of the codebase prior to the patch illustrates the structural logic flaw. The route handler maps the file retrieval process without any structural sandboxing in the initial evaluation block:

func serveExport(ginServer *gin.Engine) {
	exportGroup := ginServer.Group("/export/", model.CheckAuth)
	exportBaseDir := filepath.Join(util.TempDir, "export")
 
	exportGroup.GET("/*filepath", func(c *gin.Context) {
		// Vulnerable short-circuit branch
		if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") {
			c.File(filepath.Join(util.TempDir, c.Request.URL.Path))
			return
		}
        // ... Secure path logic with IsSubPath occurs here, but is never reached ...

The patch implemented in commit b763d787d1f2b862c577049e4ee147c5857fe413 fixes this logic vulnerability. It defines a restricted target directory and validates the components before allowing execution to proceed:

	exportGroup.GET("/*filepath", func(c *gin.Context) {
		if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") {
			tempBaseDir := filepath.Join(util.TempDir, "export", "temp")
			relativePath := strings.TrimPrefix(c.Request.URL.Path, "/export/temp/")
			relativePath = filepath.Clean(relativePath)
			
			// Explicitly block any directory traversal indicators
			if strings.Contains(relativePath, "..") {
				c.Status(http.StatusUnauthorized)
				return
			}
			
			fullPath := filepath.Join(tempBaseDir, relativePath)
			// Ensure the final resolved path physically sits inside the designated subpath
			if !gulu.File.IsSubPath(tempBaseDir, fullPath) {
				c.Status(http.StatusUnauthorized)
				return
			}
			c.File(fullPath)
			return
		}

By ensuring the relative path is stripped of the prefix, cleaned, verified against manual parent-traversal patterns, and validated via IsSubPath, the patch prevents any out-of-bounds file serving.

Exploitation of this vulnerability requires that the attacker has authenticated access to the application, satisfying the model.CheckAuth validation layer. The attack is executed via a single HTTP GET request using traversal characters encoded to escape superficial web-application firewall rules.

The target endpoint decodes the percent-encoded %2e%2e sequences to .. before assessing prefix matches. A request format like /export/temp/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd successfully triggers the short-circuit branch, traverses the server's directory structure, and outputs the target file contents.

Because the system process context is what executes the c.File() action, the scope of file exposure is constrained only by the operating system-level permissions of the user running the SiYuan process.

The direct impact of this vulnerability is the unauthorized disclosure of sensitive files from the server's local file system. This includes target system files like /etc/passwd, application database files containing proprietary notebook data, and system logs.

While the vulnerability is restricted to read operations and does not facilitate write access, retrieved information can be used to coordinate more complex system compromise campaigns. Accessing environment configuration files may expose database credentials, authentication keys, and API tokens used elsewhere in the environment.

The CVSS v3.1 score is evaluated at 6.5 (Medium). The score reflects that the vulnerability requires low privilege authentication but can be exploited with low complexity over the network, leading to high confidentiality degradation with zero impact on system availability or integrity.

The principal remediation is the direct upgrade of the SiYuan installation to a pseudo-version at or later than 0.0.0-20260510110132-b763d787d1f2 (which integrates the patch commit b763d787d1f2b862c577049e4ee147c5857fe413). This ensures that containment validation logic is enforced even during short-circuit file-serving scenarios.

For deployments where immediate system updates are not viable, administrators should restrict network-level accessibility. Keep the daemon bound strictly to localhost (127.0.0.1) and isolate the network port from untrusted external interfaces.

Additionally, Web Application Firewalls (WAFs) can be configured to filter incoming URI patterns. Rejecting any requests to the /export/ route family that contain percent-encoded directory traversal signatures like %2e%2e or /.. will prevent exploitation attempts.