Live › vulnerability › CVE-2026-73605
Go to dashboardSiYuan's getUniqueFilename endpoint accepts an arbitrary client-supplied path and checks it against the host filesystem without validation. An anonymous remote attacker can learn whether any file or directory exists on the host, which maps the layout and installed software but does not directly disclose file contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260812083335-251596fc0de2 | 0.0.0-20260812083335-251596fc0de2 |
Check the SiYuan Go module version in go.mod: go list -m github.com/siyuan-note/siyuan/kernel
Unaffected if the version is 0.0.0-20260812083335-251596fc0de2 or later; the advisory also states versions before v3.7.4 are affected.
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260812083335-251596fc0de2 or later (SiYuan v3.7.4 or later).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on the host, enabling reconnaissance of the filesystem layout and installed software.
This page as .md · .json · in your agent: get_signal("CVE-2026-73605")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.