Path Traversal in SiYuan Notebook Icon Configuration Endpoint

CVE-2026-100638 is a path traversal vulnerability affecting SiYuan versions before v3.8.4 that allows authenticated administrators to escape the workspace boundary and write arbitrary files to the system. The vulnerability exists in the setNotebookIcon endpoint, where insufficient input validation on the notebook parameter permits directory traversal sequences (such as ../ patterns) to be exploited. This is particularly dangerous because it enables attackers with admin credentials to write configuration files like conf.json to locations accessible by the kernel process, potentially leading to arbitrary code execution or system compromise. Organizations running vulnerable SiYuan instances with administrative access controls are at risk, especially in environments where admin accounts may be compromised or insider threats are a concern.

While CVE-2026-100638 does not map directly to current MITRE ATT&CK techniques, Casky's security skills powered by Claude AI with extended reasoning would detect the attack patterns associated with this vulnerability by analyzing file system operations and configuration changes. A practitioner using Casky would observe findings related to unauthorized file writes outside expected directories, suspicious conf.json modifications in unusual paths, and anomalous endpoint requests to setNotebookIcon with path traversal indicators. By correlating these behavioral signals across Casky's 754 mapped security skills, the platform would surface indicators consistent with Abuse of Elevation/Privilege (T1548) and Lateral Movement techniques, alerting defenders to potential post-exploitation activity that could follow successful exploitation of this path traversal flaw.