{"id":"CVE-2026-73605","kind":"vulnerability","aliases":["CVE-2026-73605","GHSA-hf8h-97gm-4x2p","GO-2026-6626"],"related":[],"title":"SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel","description":"SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on the host, enabling reconnaissance of the filesystem layout and installed software.","summary":"SiYuan's getUniqueFilename endpoint accepts an arbitrary client-supplied path and checks it against the host filesystem without validation. An anonymous remote attacker can learn whether any file or directory exists on the host, which maps the layout and installed software but does not directly disclose file contents.","severity":"medium","cvss":6.9,"epss":0.00325,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/siyuan-note/siyuan/kernel","fixed":["0.0.0-20260812083335-251596fc0de2"],"affected":"< 0.0.0-20260812083335-251596fc0de2","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","siyuan"],"not_affected_if":["managed-hosting","version-3.7.4-or-later"],"how_to_check":"Check the SiYuan Go module version in go.mod: go list -m github.com/siyuan-note/siyuan/kernel\nUnaffected if the version is 0.0.0-20260812083335-251596fc0de2 or later; the advisory also states versions before v3.7.4 are affected.","fix":"Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260812083335-251596fc0de2 or later (SiYuan v3.7.4 or later).","status":"open","published_at":"2026-08-13T12:17:24+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:46:01+00:00","updated_at":"2026-10-23T21:46:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:46:01Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260812083335-251596fc0de2 or later (SiYuan v3.7.4 or later).\nunknown","reach":"internet","impact":"low","summary":"SiYuan's getUniqueFilename endpoint accepts an arbitrary client-supplied path and checks it against the host filesystem without validation. An anonymous remote attacker can learn whether any file or directory exists on the host, which maps the layout and installed software but does not directly disclose file contents.","category":"package","who_cares":["siyuan","self-hosted","go"],"confidence":0.8,"needs_auth":"no","worst_case":"Anonymous attacker maps host files and installed software via existence checks","analyst_note":"","how_to_check":"Check the SiYuan Go module version in go.mod: go list -m github.com/siyuan-note/siyuan/kernel\nUnaffected if the version is 0.0.0-20260812083335-251596fc0de2 or later; the advisory also states versions before v3.7.4 are affected.\nunknown","needs_analyst":false,"not_affected_if":["managed-hosting","version-3.7.4-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000529,"input_tokens":3016,"output_tokens":455,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':29A,37A,40A '-6626':38A '-73605':30A,41A '/siyuan-note/siyuan/kernel':27A,44A '4x2p':35A '97gm':34A 'absolut':129C 'accept':55B 'allow':114C 'anonym':14A,72B,115C 'arbitrari':57B,128C 'attack':74B,125C 'check':63B 'client':7A,59B 'client-suppli':6A,58B 'confin':124C 'contain':104C 'content':99B 'cve':28A,39A 'determin':132C 'direct':96B 'directori':81B,136C 'disclos':97B 'enabl':141C 'endpoint':54B,112C 'entir':21A 'exist':17A,82B,120C,137C 'file':79B,98B,134C 'filesystem':12A,23A,68B,119C,145C 'getuniquefilenam':2A,53B,111C 'ghsa':32A 'ghsa-hf8h-97gm-4x2p':31A 'github.com':26A,43A 'github.com/siyuan-note/siyuan/kernel':25A,42A 'give':13A 'go':36A,45B 'hf8h':33A 'host':22A,49B,67B,85B,140C 'instal':91B,148C 'layout':89B,146C 'learn':76B 'map':87B 'oracl':18A 'packag':46B 'pass':3A 'path':9A,61B,106C,130C 'probe':118C 'reader':15A,116C 'reconnaiss':142C 'remot':73B 'self':48B 'self-host':47B 'siyuan':1A,50B,51B,100C 'softwar':92B,149C 'suppli':8A,60B,127C 'travers':107C 'unvalid':5A 'v3.7.4':103C 'valid':70B,122C 'version':101C 'vulner':108C 'whether':77B,133C 'without':69B,121C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-13T12:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6626","url":"https://pkg.go.dev/vuln/GO-2026-6626","severity":null,"published_at":"2026-10-07T14:09:59+00:00","modified_at":"2026-10-07T14:09:59+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-73605","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73605","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-73605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73605","severity":null,"published_at":"2026-08-13T12:17:24+00:00","modified_at":"2026-10-23T18:10:00+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}