Dashboard / CVE-2026-126776

CVE-2026-126776

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 62/100
Published: 2026-11-11 Modified: 2026-11-12 First seen: 2026-11-11 Status: active

Attack Surface

Network Low Complexity No Auth Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
AT: Present
VC: None
VI: High
VA: None

Description

SiYuan 3.7.0 before 3.8.10 on Windows contains a path traversal vulnerability in kernel/util/webfetch.go that allows attackers to write files outside the import directory via backslash-encoded filenames. Attackers controlling a URL fetched by the MCP web_fetch or http_request tools can use %5C-encoded ..\ sequences to write chosen response bytes to directories above temp/import that are writable by the SiYuan user.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
siyuan-note siyuan 3.7.0 < 3.8.10
siyuan-note siyuan 3.7.0 < 3.8.10

References & Advisories (5)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.35%
Raw Score 0.003490
Percentile 28.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00349
2026-11-12
0.00349

Intelligence Sources

mitre ref →
nvd ref →

External Links