https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T05:02:08.637002+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-77086 fkie_cve-2026-77086 2026-10-04T05:02:09.492669+00:00

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.

 https://vulnerability.circl.lu/vuln/ghsa-w7g2-952j-gmgr GHSA-w7g2-952j-gmgr 2026-10-04T05:02:09.493034+00:00

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.