SiYuan Path Traversal Allows JSON File Overwrite

SiYuan versions before v3.8.4 contain a critical path traversal vulnerability in the checkoutRepo endpoint that enables authenticated administrators to write JSON files outside the intended workspace directory. By injecting directory traversal sequences (such as '../') into the sessionID parameter, attackers can escape sandbox boundaries and overwrite arbitrary JSON files in kernel-writable directories. This vulnerability matters because it breaks the fundamental assumption that administrative actions remain confined to workspace boundaries—attackers with admin credentials can now corrupt system configurations, inject malicious settings, or compromise data integrity across the host system. Organizations running vulnerable SiYuan instances with untrusted administrators or compromised admin accounts face significant risk of lateral movement and system compromise.

While this CVE lacks direct MITRE ATT&CK technique mappings in the vulnerability record, Casky's skill-based detection framework would identify this attack through techniques like T1083 (File and Directory Discovery) and T1565 (Data Manipulation) by analyzing anomalous file write operations outside workspace boundaries. Practitioners using Casky would observe detection signals when the platform's Claude-powered analysis identifies: (1) sessionID parameters containing traversal sequences like '../' or '..\', (2) JSON file writes to unexpected system paths outside the workspace, (3) authentication context (admin accounts) combined with path traversal attempts, and (4) modifications to kernel-writable directories typically outside application scope. The extended reasoning capability would correlate these signals into a coherent attack narrative, helping security teams distinguish between legitimate administrative activity and exploitation attempts targeting this specific vulnerability class.