Path Traversal in SiYuan Export Functionality

SiYuan versions prior to v3.8.4 contain a critical path traversal vulnerability in the exportBrowserHTML endpoint. This flaw allows an authenticated administrator to manipulate the folder parameter by including directory traversal sequences. By successfully exploiting this, an attacker can escape the restricted export directory and overwrite the index.html file in any location that the application kernel has write permissions to. This vulnerability poses a significant risk for stored Cross-Site Scripting (XSS) attacks or workspace defacement, as it allows the injection of arbitrary HTML content into the application environment. Defenders should prioritize updating to SiYuan v3.8.4 or later to mitigate this risk.

Impact

The vulnerability allows authenticated administrators to perform arbitrary file writes, leading to potential stored XSS or full application-level defacement. If compromised, an attacker could inject malicious scripts into the index.html file, which would then be executed in the context of other users or administrators accessing the application, facilitating further account takeover or malicious redirections.

Recommendation

• Upgrade all SiYuan installations to version v3.8.4 or later immediately.
• Audit web server logs for suspicious POST requests to the exportBrowserHTML endpoint containing path traversal characters like '../' or '..%2f'.
• Restrict administrative access to the SiYuan interface to trusted personnel to limit the attack surface for this authenticated vulnerability.