---
id: "CVE-2026-73605"
kind: "vulnerability"
aliases: ["CVE-2026-73605", "GHSA-hf8h-97gm-4x2p", "GO-2026-6626"]
title: "SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel"
severity: "medium"
cvss: 6.9
epss: 0.00325
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/siyuan-note/siyuan/kernel", "fixed": ["0.0.0-20260812083335-251596fc0de2"], "affected": "< 0.0.0-20260812083335-251596fc0de2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "package", "self-hosted", "siyuan"]
not_affected_if: ["managed-hosting", "version-3.7.4-or-later"]
published_at: "2026-08-13T12:17:24+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:46:01+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6626", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-73605", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73605", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel

SiYuan's getUniqueFilename endpoint accepts an arbitrary client-supplied path and checks it against the host filesystem without validation. An anonymous remote attacker can learn whether any file or directory exists on the host, which maps the layout and installed software but does not directly disclose file contents.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/siyuan-note/siyuan/kernel affected < 0.0.0-20260812083335-251596fc0de2 fixed 0.0.0-20260812083335-251596fc0de2

## How to check

Check the SiYuan Go module version in go.mod: go list -m github.com/siyuan-note/siyuan/kernel
Unaffected if the version is 0.0.0-20260812083335-251596fc0de2 or later; the advisory also states versions before v3.7.4 are affected.

## Fix

Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260812083335-251596fc0de2 or later (SiYuan v3.7.4 or later).

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6626
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-73605
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-73605

## From the sources

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on the host, enabling reconnaissance of the filesystem layout and installed software.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_