{"id":"GHSA-3cm4-ccvw-6xr6","kind":"vulnerability","aliases":["GHSA-3cm4-ccvw-6xr6","GO-2026-6662"],"related":[],"title":"SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel","summary":"SiYuan's kernel exposes history and repo diff endpoints that can return historical snapshots of data/.siyuan/publishAccess.json and data/templates/* files. An attacker who can reach those endpoints can read past versions of publish access settings and templates.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/siyuan-note/siyuan/kernel","fixed":["0.0.0-20260816034002-035bf9a8c311"],"affected":"< 0.0.0-20260816034002-035bf9a8c311","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","siyuan"],"not_affected_if":["default-config"],"how_to_check":null,"fix":"Update github.com/siyuan-note/siyuan/kernel to version 0.0.0-20260816034002-035bf9a8c311 or later.","status":"open","published_at":"2026-10-07T14:10:39+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:20:10+00:00","updated_at":"2026-10-23T20:20:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:20:10Z","model":"claude-haiku-5-5","output":{"fix":"Update github.com/siyuan-note/siyuan/kernel to version 0.0.0-20260816034002-035bf9a8c311 or later.\nunknown","summary":"SiYuan's kernel exposes history and repo diff endpoints that can return historical snapshots of data/.siyuan/publishAccess.json and data/templates/* files. An attacker who can reach those endpoints can read past versions of publish access settings and templates.","category":"package","who_cares":["go","siyuan","self-hosted"],"confidence":0.6,"analyst_note":"Sources do not give severity, auth requirements, or exposure conditions; check https://pkg.go.dev/vuln/GO-2026-6662 and the GHSA advisory for whether the endpoints need authentication.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"severity_if_unknown":"unknown"},"cost_usd":0.000368,"input_tokens":2118,"output_tokens":313,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':25A '-6662':26A '/history':2A,78C '/repo/diff':5A,81C '/siyuan-note/siyuan/kernel':18A,34A,94C '3cm4':21A,29A '6xr6':23A,31A 'access':73B 'attack':61B 'ccvw':22A,30A 'data/.siyuan/publishaccess.json':12A,56B,88C 'data/templates':14A,58B,90C 'diff':48B 'endpoint':49B,66B 'expos':8A,44B,84C 'file':59B 'ghsa':20A,28A 'ghsa-3cm4-ccvw-6xr6':19A,27A 'github.com':17A,33A,93C 'github.com/siyuan-note/siyuan/kernel':16A,32A,92C 'go':24A,35B 'histor':9A,53B,85C 'histori':45B 'host':39B 'kernel':43B 'packag':36B 'past':69B 'path':3A,6A,79C,82C 'potenti':7A,83C 'publish':72B 'reach':64B 'read':68B 'repo':47B 'return':52B 'self':38B 'self-host':37B 'set':74B 'siyuan':1A,40B,41B,77C 'snapshot':10A,54B,86C 'templat':76B 'version':70B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T14:10:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6662","url":"https://pkg.go.dev/vuln/GO-2026-6662","severity":null,"published_at":"2026-10-07T14:10:39+00:00","modified_at":"2026-10-07T14:10:39+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}