Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 20:36:49 +0000 CVE-2026-77086 — SiYuan before v3.7.4 Path Traversal via packageName https://vulnerability.circl.lu/vuln/cve-2026-77086 <p><strong>Affected:</strong> siyuan-note siyuan</p> <p>SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.</p> <p><strong>Affected:</strong> siyuan-note siyuan</p> <p>SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.</p> https://vulnerability.circl.lu/vuln/cve-2026-77086