CVE-2026-30869 is a critical path traversal flaw (CVSS 9.3) in the export endpoint of SiYuan before 3.5.10. It allows reading arbitrary files, including the configuration file that holds the API token. Upgrade to SiYuan 3.5.10 and rotate the secrets.
What's affected
SiYuan, a personal knowledge management system, is affected in versions before 3.5.10. The fix is in 3.5.10.
How to check if you're exposed
Open the About page in SiYuan and read the version, or check the image tag if you run the kernel in Docker:
docker ps --format '{{.Names}} {{.Image}}'
Also check whether the SiYuan kernel is reachable from outside your machine or network. The flaw is exploitable over the network without a login.
What to do now
- Upgrade SiYuan to 3.5.10 or later.
- Assume the contents of
conf/conf.jsonmay have been exposed if the instance was reachable. Change the API token and the workspace access authentication code, and replace the cookie signing key. - Do not expose the kernel to the internet. Put it behind a VPN or an authenticating reverse proxy.
- Look at web server logs for requests to the export endpoint that contain encoded traversal sequences.
Why it matters
The weakness class is CWE-22, path traversal. The export endpoint did not handle double encoded traversal sequences safely, so a request could leave the intended directory and read other files on the server.
The impact comes from what sits in the configuration file. The record says it contains the API token, the cookie signing key and the workspace access authentication code. Leaking those may give administrative access to the kernel API and, in some deployments, could be chained into remote code execution. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Why rotate secrets after upgrading?
A patch stops new reads but does not undo a past leak. If the file was read, the old token and keys still work until you change them.
Does this need a login?
The CVSS vector lists no privileges and no user interaction required.
Sources
Last reviewed: 19 October 2026.
