https://vulnerability.circl.lu/sightings/feed 2026-10-01T22:12:57.270401+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/44547a68-a4e8-4b61-8649-6ab0a726fb7b/export 2026-10-01T22:12:57.292740+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "44547a68-a4e8-4b61-8649-6ab0a726fb7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73605", "type": "seen", "source": "https://gist.github.com/alon710/22096450d45afa6904ca64bbc851447c", "content": "# CVE-2026-73605: CVE-2026-73605: Path Traversal and File Existence Oracle via getUniqueFilename Endpoint in SiYuan\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73605\n\n## Summary\nAn authorization bypass and path traversal vulnerability exists in the SiYuan knowledge workspace platform. The vulnerability is located in the '/api/file/getUniqueFilename' endpoint inside the 'github.com/siyuan-note/siyuan/kernel' package. Under default configurations, this route is exposed to users who satisfy basic authentication middleware checks, which includes anonymous readers in publish mode. By supplying unvalidated absolute paths, remote attackers can verify the existence of files and directories across the host operating system, establishing a high-fidelity file existence oracle.\n\n## TL;DR\nUnauthenticated remote users can verify the existence of files and folders on the host operating system by sending crafted path parameters to the SiYuan file utility endpoint, leading to sensitive host system information disclosure.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Base Score**: 6.9\n- **EPSS Score**: 0.00325 (Percentile: 23.19%)\n- **Impact**: Filesystem structure reconnaissance\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan personal knowledge management system\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later\n- Restrict access to the SiYuan API via network access control lists\n- Disable anonymous publish mode if not strictly required\n\n**Remediation Steps:**\n1. Identify all active instances of SiYuan running versions prior to v3.7.4\n2. Apply the v3.7.4 update from the official source\n3. Verify that the /api/file/getUniqueFilename endpoint no longer accepts absolute paths outside the workspace\n\n## References\n\n- [NVD - CVE-2026-73605](https://nvd.nist.gov/vuln/detail/CVE-2026-73605)\n- [CVE.org - CVE-2026-73605](https://www.cve.org/CVERecord?id=CVE-2026-73605)\n- [GitHub Security Advisory GHSA-hf8h-97gm-4x2p](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hf8h-97gm-4x2p)\n- [VulnCheck Advisory Portal](https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-getuniquefilename)\n- [SiYuan Repository](https://github.com/siyuan-note/siyuan)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73605) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T16:30:30.000000Z"} 2026-10-01T16:30:30+00:00 https://vulnerability.circl.lu/sighting/d64623e4-be89-471f-ab6b-bf35bf04cdf4/export 2026-10-01T22:12:57.296383+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "d64623e4-be89-471f-ab6b-bf35bf04cdf4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73605", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-hf8h-97gm-4x2p", "content": "", "creation_timestamp": "2026-10-01T15:46:01.000000Z"} 2026-10-01T15:46:01+00:00