CVE-2026-59832

Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

Published

2026-09-02

Modified

2026-09-02

EPSS percentile

39%

Aliases

GHSA-275h-v5h9-vr82

Sources

github-advisory

Summary

Reporter: Cavan Loughran, Celvex Group Inc. Summary ------- The /snippets/*filepath route handler serveSnippets in kernel/server/serve.go performs a bare filepath.Join(util.SnippetsPath, filePath) on the single-decoded c.Request.URL.Path and serves the result with c.File(), with NO IsSubPath containment and NO IsSensitivePath denylist - unlike the sibling /export/ (serveExport) and /appearance/ (serveAppearance) handlers, which both carry IsSubPath, and unlike /assets/ (serveAssets), whose traversal was fixed in GHSA-p4m3-mgmm-c664. Because util.SnippetsPath = WorkspaceDir/data/snippets, an authenticated request to GET /snippets/%2e%2e/%2e%2e/conf/conf.json resolves to WorkspaceDir/conf/conf.json and leaks the kernel API token and AccessAuthCode (the same secret file CVE-2026-30869 leaked from /export/); GET /snippets/%2e%2e/%2e%2e/temp/siyuan.db leaks the full document database. Affected versions ----------------- v3.6.5 and current master (verified by direct source read). The /export/ and /assets/ fixes were endpoint-scoped and never reached serveSnippets. Technical detail ---------------- Sink, kernel/server/serve.go, serveSnippets (verbatim, current master and v3.6.5): func serveSnippets(ginServer *gin.Engine) { ginServer.Handle("GET", "/snippets/*filepath", model.CheckAuth, func(c *gin.Context) { filePath := strings.TrimPrefix(c.Request.URL.Path, "/snippets/") if !model.IsAdminRoleContext(c) { if "conf.json" == filePath { c.Status(http.StatusUnauthorized) return } } ext := filepath.Ext(filePath) name := strings.TrimSuffix(filePath, ext) confSnippets, err := model.LoadSnippets() ... for _, s := range confSnippets { if s.Name == name && ("" != ext && s.Type == ext[1:]) { c.Header("Content-Type", mime.TypeByExtension(ext)) c.String(http.StatusOK, s.Content) return } } // when not matched in the config file, look it up on the filesystem filePath = filepath.Join(util.SnippetsPath, filePath) // <-- TAINTED join, no containment c.File(filePath) // <-- arbitrary workspace file read }) } Taint path, end to end: 1. Route GET /snippets/*filepath is registered with the single middleware model.CheckAuth (authentication only; NO CheckAdminRole). 2. c.Request.URL.Path is the request path AFTER Go net/http has percent-decoded it ONCE. The kernel runs gin.New() with default settings (UseRawPath = false, UnescapePathValues = true) and installs NO path-sanitizing middleware (the global ginServer.Use(...) chain is ControlConcurrency, Timing, Recover, corsMiddleware(), jwtMiddleware, gzip, sessions only - none cleans or rejects ..). net/http does not path.Clean URL.Path for gin handlers, so a single-encoded %2e%2e arrives at the handler as a literal .. segment. 3. filePath := strings.TrimPrefix(c.Request.URL.Path, "/snippets/") yields the attacker-controlled remainder, e.g. ../../conf/conf.json. 4. The non-admin guard checks only "conf.json" == filePath; with traversal the value is "../../conf/conf.json", so the guard does not fire (and admins are not checked at all). 5. The config-snippet name/ext loop does not match a traversal string, so control falls through to the filesystem branch. 6. filePath = filepath.Join(util.SnippetsPath, filePath): Go's filepath.Join runs Clean, which RESOLVES .. segments. Clean("WorkspaceDir/data/snippets" + "/../../conf/conf.json") = WorkspaceDir/conf/conf.json. There is no IsSubPath confinement, so the resolved path escapes the snippets root. 7. c.File(filePath) streams the resolved file to the response body. Directory layout (confirmed by kernel/util/working.go): WorkspaceDir/ data/snippets/ = util.SnippetsPath (the /snippets/ base) conf/conf.json <-- API token + AccessAuth

Affected packages

Remediation: Upgrade to 0.0.0-20260704035520-68cc0f537dfa or later.

References

• https://github.com/advisories/GHSA-275h-v5h9-vr82