01 Record

CVE-2026-77086

SiYuan before v3.7.4 Path Traversal via packageName

CriticalPUBLISHEDCNA: VulnCheck

Base score9.4 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

02 Description

SiYuan before v3.7.4 Path Traversal via packageName

Published

2026-08-21 11:05Z14 HR AGO

Last updated

2026-08-21 11:46Z13 HR AGO

Reserved

2026-08-20

Assigning CNA

VulnCheck

Record state

PUBLISHED

Severity

Critical (CVSS 9.4)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Weaknesses

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Base

SSVC decision

ExploitationnoneAutomatablenoTechnical Impacttotal

Data version

5.2

Document digest

92586cd2c4635fb6808d519cc55f30e667be24216756d49c456f2c8616a2b7ee

VendorProductVersionsPlatforms

siyuan-notesiyuan0 to < 3.7.4—

github.comGitHub Security Advisory (GHSA-wr4w-7vjm-mmx3)https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wr4w-7vjm-mmx3vendor-advisory
www.vulncheck.comVulnCheck Advisory: SiYuan before v3.7.4 Path Traversal via packageNamehttps://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-packagenamethird-party-advisory