Cloudanix VulnDB

GHSA-vw86-c94w-v3x4

High · 8.5

SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

CVSS

8.5

EPSS

—

Published

Apr 10, 2026

CISA due date

—

The record

SiYuan's publish/read-only boundary can be broken through `/api/av/removeUnusedAttributeView`. A publish-service Reader context can call this endpoint because it is protected only by `CheckAuth`, and publish requests are forwarded upstream with a valid `RoleReader` JWT. The handler accepts attacker-controlled `id` input and passes it directly into a filesystem delete sink: - no admin check - no readonly check - no node-ID validation - no subpath enforcement - no verification that the target AV is actually unused Because the sink builds the file path with: ```go filepath.Join(util.DataDir, "storage", "av", id+".json") ``` an attacker can supply `../` path traversal sequences and delete arbitrary `.json` files reachable from the workspace, rather than only `data/storage/av/<id>.json`. This is a real write/destructive authorization bug, not a `visible=false` listing issue.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities