—

GO-2026-6373

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure in github.com/siyuan-note/siyuan/kernel

Quick fix

GO-2026-6373 — github.com/siyuan-note/siyuan/kernel: upgrade to the fixed version with the command below.

go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260720151813-0f5a0e7c67b0

Details

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure in github.com/siyuan-note/siyuan/kernel

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/siyuan-note/siyuan/kernel

Introduced in: 0Fixed in: 0.0.0-20260720151813-0f5a0e7c67b0

Fixgo get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260720151813-0f5a0e7c67b0

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7hm9-v7vf-7g4w[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2026-69086[ADVISORY]
https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-unvalidated-avid[WEB]