Product

Siyuan Kernel (Versions Prior to 0.0.0-20260628153353-2d5d72223df4)

1 brief RSS

SiYuan Path Traversal Vulnerability (CVE-2026-54066) via Double URL Encoding

An incomplete fix for CVE-2026-41894 in SiYuan's 'publish mode' allows unauthenticated remote attackers to perform path traversal by double URL-encoding '..' segments in requests to the '/assets/*path' route, leading to the read of arbitrary files within the 'WorkspaceDir'.

siyuan kernel path-traversal vulnerability web-vulnerability arbitrary-file-read

1r 3t 2c 1i 2h ago