CVE-2026-109309

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109309
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109309.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109309
Aliases
  • GHSA-phmw-4rgv-r4xv
Published
2026-10-12T16:05:05Z
Modified
2026-10-28T02:31:05Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
Details

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109309.json"
}
References

Affected packages

Git / github.com/siyuan-note/siyuan

Affected ranges

Type
GIT
Repo
https://github.com/siyuan-note/siyuan
Events
Introduced
27e0051e0d067892e833df1063cb2fb469600e98
Fixed
158812497497c6fa8a6d1031bfa2f025a61ee5c2
Fixed
c6494375ea40ee973f430f0e85d50f1862a30d81
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.7.0"
                },
                {
                    "fixed": "3.8.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "c6494375ea40ee973f430f0e85d50f1862a30d81"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109309.json"