CVE-2026-30869: 
NixOS vulnerability analysis and mitigation

CVE-2026-30869 is a path traversal vulnerability in the /export endpoint of SiYuan, a personal knowledge management system developed by b3log. It allows unauthenticated remote attackers to read arbitrary files from the server filesystem by exploiting double-encoded traversal sequences. All versions up to and including 3.5.9 are affected; the vulnerability was fixed in version 3.5.10. It was published on March 6, 2026, and has a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory, SiYuan Advisory).

The root cause is improper path validation (CWE-22) in serve.go and session.go. The /export endpoint strips the /export/ prefix from the request URI, then calls url.PathUnescape() on the remaining path, and passes the result directly to filepath.Join(exportBaseDir, decodedPath) without verifying that the resolved path remains within exportBaseDir. Double-encoded traversal sequences such as %252e%252e bypass Go's ServeFile dot-dot rejection (which only checks single-encoded ..) but are decoded by the application's own logic into .., enabling directory traversal. Compounding the issue, session.go grants administrator-level access to any localhost request targeting /export/*, and the server sets Access-Control-Allow-Origin: *, enabling cross-origin exploitation of local instances from malicious websites (SiYuan Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to read any file accessible to the SiYuan process, including system files such as /etc/passwd and application configuration files like conf/conf.json. The configuration file exposes highly sensitive secrets including API tokens, cookie signing keys, and workspace authentication codes, which can be used to gain administrative access to the SiYuan kernel API. The wildcard CORS header (Access-Control-Allow-Origin: *) further enables malicious websites to silently exfiltrate data from a victim's local SiYuan instance running on 127.0.0.1. In certain deployment scenarios, the leaked secrets may be chained with other application features to achieve remote code execution or full system compromise (SiYuan Advisory).

A proof-of-concept with concrete reproduction steps is publicly available in the GitHub Security Advisory, requiring only standard HTTP GET requests with no authentication, no special privileges, and no user interaction (SiYuan Advisory). The EPSS score is approximately 0.27% (51st percentile), indicating a moderate relative probability of exploitation within 30 days (GitHub Advisory). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability does not appear in the CISA KEV catalog. No specific threat actor attribution has been made.

1. Reconnaissance: Identify internet-facing or locally running SiYuan instances (versions ≤ 3.5.9) using network scanners, Shodan, or by targeting the default port (typically 6806).
2. Craft double-encoded traversal payload: Construct a URL using double-encoded dot-dot sequences (%252e%252e instead of ..) to escape the export directory. For example: GET /export/%252e%252e/%252e%252e/conf/conf.json.
3. Send the request: Issue the crafted GET request to the target SiYuan instance. No authentication headers are required. For local instances, this can be triggered from a malicious webpage via a cross-origin fetch due to the Access-Control-Allow-Origin: * header.
4. Extract sensitive data: If an HTTP 200 response is returned, parse the response body for sensitive fields: api.token, cookieKey, and accessAuthCode from conf/conf.json, or user account data from /etc/passwd using a deeper traversal path (e.g., export/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd).
5. Leverage extracted secrets: Use the obtained api.token to authenticate against privileged SiYuan kernel APIs, e.g., POST /api/system/getNetwork with the header Authorization: Token <extracted_token>, to confirm administrative access.
6. Chain for further compromise: Use administrative API access to explore additional application features that may enable remote code execution or lateral movement within the deployment environment (SiYuan Advisory).

• Network: Unusual HTTP GET requests to the /export/ endpoint containing %252e or %25 sequences in the path; requests to /export/ paths resolving outside the expected export directory (e.g., referencing conf/conf.json or etc/passwd); unexpected cross-origin requests from external domains to a local SiYuan instance on port 6806.
• Logs: SiYuan access logs showing GET requests to paths like /export/%252e%252e/%252e%252e/conf/conf.json or similar double-encoded traversal patterns returning HTTP 200 responses; repeated requests to /export/ with varying traversal depths.
• File System: No direct file system artifacts are created by read-only exploitation; however, monitor for unexpected access to conf/conf.json or system files in application logs.
• Process/API: Unexpected or unauthorized calls to privileged SiYuan kernel API endpoints (e.g., /api/system/getNetwork, /api/system/setConf) using API tokens that may have been exfiltrated; API calls from unfamiliar IP addresses using valid tokens (SiYuan Advisory).

Upgrade SiYuan to version 3.5.10 or later, which contains the official fix for this vulnerability (GitHub Advisory, SiYuan Advisory). As interim mitigations, restrict network access to SiYuan instances to trusted networks or localhost only, and use a firewall or reverse proxy to block external access to the /export/ endpoint. After patching, rotate all potentially exposed secrets: API tokens, cookie signing keys, and workspace authentication codes found in conf/conf.json. Review access logs for evidence of exploitation using the IOCs described above.

The vulnerability was reported by researcher "Zwique" and disclosed via GitHub Security Advisories on March 6, 2026 (SiYuan Advisory). Security community members discussed the issue on Mastodon and Bluesky shortly after disclosure, and several threat intelligence and advisory aggregators (including Yazoul, CyberHub, and InfinitSec) published write-ups highlighting the severity and exploitation path. An incomplete fix bypass was subsequently identified as CVE-2026-41894, indicating continued researcher attention to this vulnerability class in SiYuan.