Summary
SiYuan versions before v3.7.3 contain a path traversal issue in attribute-view read endpoints where the avID parameter is not fully validated across all code branches.
Authenticated RoleReader users, or anonymous clients when publish authentication is disabled, can craft traversal paths to escape the storage directory and read JSON files outside the intended attribute-view scope, potentially exposing database content across contexts.
Affected context
This vulnerability arises in SiYuan's attribute-view read APIs, which accept an avID parameter used to locate JSON resources on disk.
The risk materializes when server-side path normalization or validation is incomplete or inconsistent, allowing directory traversal sequences to be processed.
Environments where RoleReader accounts have broad access, or where publish authentication is disabled for public access, are more exposed because those clients can reach the affected endpoints without additional privilege checks.
Exploit preconditions
- Attack surface: HTTP attribute-view read endpoints that process avID from client requests
- Required access:
- Authenticated access with RoleReader permissions, or
- Anonymous access if publish authentication is disabled
- Trigger point: Supplying avID values containing directory traversal segments (e.g.,
../) or crafted paths that resolve outside the intended storage directory - Why exploitation is possible: The server fails to consistently validate and constrain avID to the attribute-view directory on all code branches, so filesystem reads can follow attacker-influenced paths beyond the storage boundary
Why this happens
The core issue is insufficient path validation when resolving file system locations from user-provided identifiers.
Instead of strictly binding avID to a predefined directory and rejecting paths that contain traversal patterns or absolute references, some code paths treat avID as a flexible path fragment.
This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, where attacker-controlled input drives file resolution logic and bypasses directory confines, leading to unintended access to other JSON files and database-related content.
Potential impact
- Attackers may read JSON files stored outside the attribute-view directory.
- Sensitive cross-scope database content could be exposed to lower-privileged users.
- Configuration or metadata files in adjacent directories may be disclosed.
- Information obtained can be used to pivot to further attacks such as privilege escalation or data correlation.
General mitigation guidance
Effective mitigation centers on strictly confining file access to controlled directories and treating all path-related user input as untrusted.
Common defensive patterns include:
- Resolving avID against a fixed, whitelisted base directory and rejecting any paths that attempt to traverse upward or reference absolute locations.
- Normalizing paths before use and enforcing checks that the final resolved path remains inside the intended attribute-view storage directory.
- Using opaque identifiers (e.g., database IDs) rather than direct file system paths in API parameters to decouple client input from path resolution.
- Applying least-privilege principles to data exposure so that attribute views only return information explicitly intended for the calling role or public context.
How teams detect issues like this
Organizations can detect similar path traversal risks by:
- Running static analysis checks for file access functions that accept raw or minimally validated request parameters as path components.
- Reviewing code for manual concatenation of paths (e.g., using
+or simple string joins) instead of safe path utilities and boundary checks. - Implementing security-focused code review policies that flag any use of user-supplied data in file system operations without normalization and directory confinement.
- Using automated HTTP security testing tools or fuzzers to send traversal payload patterns to file-reading endpoints and monitor for unexpected file disclosure.
