Summary
A path traversal vulnerability in SiYuan's exportBrowserHTML endpoint allows authenticated administrators to direct exported HTML outside the intended workspace directory. If a crafted folder value reaches the file-writing logic, an attacker may overwrite index.html in a pre-existing kernel-writable location, enabling stored cross-site scripting or workspace defacement.
Affected context
The issue occurs in SiYuan deployments that expose the exportBrowserHTML functionality and accept attacker-influenced folder parameters for export operations. Exploitation depends on the process having write access to a target location outside the intended export directory and on an authenticated administrator account being available.
Exploit preconditions
- Attack surface: The
exportBrowserHTMLendpoint - Required access: Authentication with administrator-level privileges
- Trigger point: Processing an export request containing a manipulated folder parameter
- Filesystem condition: The target location must already exist and be writable by the SiYuan kernel process
- Why exploitation is possible: Directory traversal sequences are not sufficiently constrained before the resulting path is used to write
index.html
Why this happens
The vulnerability results from insufficient canonicalization and boundary enforcement for a user-influenced filesystem path. When traversal components are accepted in the folder parameter, the resolved output path can escape the designated export directory and reach another kernel-writable location. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
Potential impact
- An attacker may overwrite an existing
index.htmlfile in a writable location. - Malicious HTML may enable stored cross-site scripting when subsequently rendered.
- Workspace content or presentation may be defaced.
- Application integrity and user trust could be reduced.
- A compromised writable web-facing location could expose additional users to attacker-controlled content.
General mitigation guidance
Mitigation generally focuses on treating export destinations as controlled filesystem resources rather than trusted user input.
Common defensive patterns include:
- Resolving and canonicalizing paths before use, then enforcing that the result remains beneath an approved export root.
- Rejecting traversal components and ambiguous path encodings through centralized validation.
- Allowing only server-selected export directories or opaque destination identifiers.
- Applying strict filename and extension policies for generated content.
- Limiting the kernel process to the minimum filesystem permissions required for normal operation.
- Separating exported content from privileged, shared, or web-served locations where possible.
- Applying appropriate browser protections and content policies to reduce the impact of stored HTML injection.
How teams detect issues like this
Organizations can look for path traversal risks through:
- Static analysis rules identifying filesystem writes that combine request parameters with paths.
- Code review checks for missing canonicalization, root-boundary validation, and symlink-aware handling.
- Runtime monitoring for export requests containing traversal markers, encoded separators, or unexpected destination changes.
- File-integrity monitoring for unauthorized changes to
index.htmland other sensitive files. - Policy enforcement requiring approved directory APIs and centralized path-validation utilities.
Automated security review tools may help identify tainted input flowing into file creation or overwrite operations.
