Path Traversal in SiYuan Export Endpoint Enables HTML Overwrite

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences to escape the export directory and overwrite index.html in any pre-existing kernel-writable location, enabling stored XSS or workspace defacement.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SiYuan, a popular note-taking and knowledge management platform, contains a critical path traversal vulnerability in versions before v3.8.4 affecting the exportBrowserHTML endpoint. Authenticated administrators can exploit insufficient input validation on the folder parameter to escape the intended export directory using directory traversal sequences (e.g., ../../../), allowing them to write arbitrary HTML content to index.html in any kernel-writable location outside the workspace. This vulnerability matters because it enables stored XSS attacks and workspace defacement—attackers with admin credentials can inject malicious scripts that execute in users' browsers or corrupt critical application files. Organizations deploying SiYuan for sensitive documentation and knowledge management are at risk, particularly those with multiple administrators or compromised admin accounts.

Casky's 351 matching skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across two critical MITRE ATT&CK techniques: Initial Access (TA0001) and Discovery (TA0007). Practitioners using Casky would identify exploitation signals through detection of suspicious exportBrowserHTML requests containing path traversal payloads (../ sequences), unusual file write operations targeting index.html outside expected directories, and HTML content injection attempts in POST parameters. The platform's skills would correlate these indicators with admin authentication events and file system modifications, surfacing findings that reveal the attacker's reconnaissance of writable directories and subsequent arbitrary file write attempts—allowing security teams to pinpoint compromised admin accounts and malicious export requests before stored XSS payloads execute or persistent defacement occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-100636.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-100636

Casky has 351 skills that investigate the attack patterns behind CVE-2026-100636. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn