CVE-2026-77086
CriticalCVSS 9.1Summary
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal. Attackers with admin access can write arbitrary files or recursively delete directories by supplying crafted packageName values.
Risk Assessment
An authenticated administrator can gain full control over the server's file system, potentially leading to system takeover or data loss.
Recommendation
Immediately upgrade SiYuan to version v3.7.4 or later, which includes a fix for the packageName validation.
Original NVD description (English source)
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.