GHSA-gw25-m53r-qh88 SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

• Go github.com/siyuan-note/siyuan/kernel: < 0.0.0-20260510110132-b763d787d1f2 → fixed in 0.0.0-20260510110132-b763d787d1f2

Summary SiYuan's `/export/` file handler was hardened against export disclosure (issue #12213) by adding an `IsSubPath(exportBaseDir, fullPath)` check and an `IsSensitivePath()` check in commit `bb481e1`. These guards were added only to the main branch of the handler. The handler begins with a short-circuit branch: ```go if strings.HasPrefix(c.Request.URL.Path, "/export/temp/") { c.File(filepath.Join(util.TempDir, c.Request.URL.Path)) return } ``` This branch joins the broader `util.TempDir` with the raw, percent-decoded request path and serves it with neither `IsSubPath` nor `IsSensitivePath`. An authenticated request to `/export/temp/%2e%2e/.../etc/passwd` traverses out of `TempDir` and reads arbitrary files - exactly the sensitive-file disclosure the patch intended to prevent. Present in the latest master. Affected • From commit `bb481e1` (the hardening) through the latest master. • Requires SiYuan access authorization (`model.CheckAuth`) - but the patch's stated goal is to deny sensitive-file export even to authorized callers. Root cause `kernel/server/serve.go` `serveExport()`: the main branch has `IsSubPath` + `IsSensitivePath`; the `/export/temp/` short-circuit branch (above it) has neither and uses `util.TempDir` as its root. `c.Request.URL.Path` is percent-decoded by net/http, so `%2e%2e` becomes `..` and `filepath.Join` collapses it. Incomplete-fix lineage • Export disclosure (issue #12213; CVE-2026-30869) -> fix `bb481e1` / `d68bd5a` (GHSA-6865-qjcf-286f): guards on the main branch + `IsSensitivePath` extended to `*.db`/`*.log`. • Follow-up CVE-2026-41894 (GHSA-hjh7-r5w8-5872) in the same `/export` path family. • The `/export/temp/` short-circuit branch was never covered by the guards (this report). Proof of concept (benign) 1. Authenticate (access auth code). 2. `GET /export/` (main branch) -> 401/403 (guards work). 3. `GET /export/temp/%2e%2e/%2e%2e/.../tmp/` (or `/etc/hostname`) -> 200 + file content, demonstrating the unguarded traversal. The PoC reads only a planted marker / `/etc/hostname`; no credentials. Impact Authenticated arbitrary file read bypassing the sensitive-file protection: `/etc/passwd`, `~/.ssh/*`, SiYuan `*.db` workspace data, `*.log`. Remediation • Apply `IsSubPath` + `IsSensitivePath` to the `/export/temp/` branch (or restrict its root to `TempDir/temp` with an `IsSubPath` check). • `filepath.Clean` the request path and reject `..`. • Merge both branches into one guarded file-serving function. References • Hardening advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f (commit d68bd5a); issue #12213. • CVE chain: CVE-2026-30869 -> CVE-2026-41894 (GHSA-hjh7-r5w8-5872). • serve.go guards commit: https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7 • Residual source (master): `kernel/server/serve.go` `serveExport()` lines 308-312.