CVE-2026-77086 — SiYuan before v3.7.4 Path Traversal via packageName
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via d…
Published: 2026-08-21 · CVSS: 9.4 · CVSS 4.0
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7