CVE-2026-77086CWE-22path-traversal

CVE-2026-77086

Critical · published August 21, 2026

CVSS v3.1

9.1

EPSS

Percentile

63.3

In the wild

Unconfirmed

What it is

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.

The record

Technical detail

CVSS v3.1: 9.1 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: 9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS: 0.01028 · 63.3th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2026-08-21T15:17Z

References (2)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wr4w-7vjm-mmx3 · [email protected]https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-packagename · [email protected]

EPSS history

Timeline

21 AUG 11:05Z
SiYuan before v3.7.4 Path Traversal via packageName
cvelistv5