Siyuan Go Package Vulnerability: Authenticated Path Traversal
EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
- Severity
- HIGH
- Affected component
- siyuan (go)
- Affected versions
- >= v3.5.9, <= v3.5.9 or >= v3.5.8, <= v3.5.8 or >= v3.5.8-dev2, <= v3.5.8-dev2 or >= v3.5.7, <= v3.5.7 or >= v3.5.5, <= v3.5.5 or >= v3.5.4, <= v3.5.4 or >= v3.5.4-dev5, <= v3.5.4-dev5 or >= v3.5.4-dev3, <= v3.5.4-dev3 or >= v3.5.4-dev2, <= v3.5.4-dev2 or >= v3.5.4-dev1, <= v3.5.4-dev1 or >= v3.5.3, <= v3.5.3 or >= v3.5.3-dev5, <= v3.5.3-dev5 or >= v3.5.3-dev4, <= v3.5.3-dev4 or >= v3.5.3-dev3, <= v3.5.3-dev3 or >= v3.5.3-dev2, <= v3.5.3-dev2 or >= v3.5.2, <= v3.5.2 or >= v3.5.2-dev2, <= v3.5.2-dev2 or >= v3.5.2-dev1, <= v3.5.2-dev1 or >= v3.5.1, <= v3.5.1 or >= v3.5.1-dev2, <= v3.5.1-dev2 or >= v3.5.1-dev1, <= v3.5.1-dev1 or >= v3.5.0, <= v3.5.0 or >= v3.5.0-dev2, <= v3.5.0-dev2 or >= v3.5.0-dev1, <= v3.5.0-dev1 or >= v3.4.2, <= v3.4.2 or >= v3.4.2-dev1, <= v3.4.2-dev1 or >= v3.4.1, <= v3.4.1 or >= v3.4.1-dev1, <= v3.4.1-dev1 or >= v3.4.0, <= v3.4.0 or >= v3.4.0-dev5, <= v3.4.0-dev5 or >= v3.4.0-dev4, <= v3.4.0-dev4 or >= v3.4.0-dev3, <= v3.4.0-dev3 or >= v3.4.0-dev2, <= v3.4.0-dev2 or >= v3.4.0-dev1, <= v3.4.0-dev1 or >= v3.3.6, <= v3.3.6 or >= v3.3.6-dev2, <= v3.3.6-dev2 or >= v3.3.6-dev1, <= v3.3.6-dev1 or >= v3.3.5, <= v3.3.5 or >= v3.3.4, <= v3.3.4 or >= v3.3.4-dev2, <= v3.3.4-dev2 or >= v3.3.4-dev1, <= v3.3.4-dev1 or >= v3.3.3, <= v3.3.3 or >= v3.3.3-dev5, <= v3.3.3-dev5 or >= v3.3.3-dev4, <= v3.3.3-dev4 or >= v3.3.3-dev3, <= v3.3.3-dev3 or >= v3.3.3-dev2, <= v3.3.3-dev2 or >= v3.3.3-dev1, <= v3.3.3-dev1 or >= v3.3.2, <= v3.3.2 or >= v3.3.2-dev2, <= v3.3.2-dev2 or >= v3.3.2-dev1, <= v3.3.2-dev1 or >= v3.3.1, <= v3.3.1 or >= v3.3.0, <= v3.3.0 or >= v3.3.0-dev4, <= v3.3.0-dev4 or >= v3.3.0-dev3, <= v3.3.0-dev3 or >= v3.2.1, <= v3.2.1 or >= v3.2.1-dev6, <= v3.2.1-dev6 or >= v3.2.1-dev5, <= v3.2.1-dev5 or >= v3.2.1-dev4, <= v3.2.1-dev4 or >= v3.2.1-dev3, <= v3.2.1-dev3 or >= v3.2.1-dev2, <= v3.2.1-dev2 or >= v3.2.0-dev10, <= v3.2.0-dev10 or >= v3.2.0-dev9, <= v3.2.0-dev9 or >= v3.2.0-dev8, <= v3.2.0-dev8 or >= v3.2.0-dev6, <= v3.2.0-dev6 or >= v3.2.0-dev4, <= v3.2.0-dev4 or >= v3.2.0-dev3, <= v3.2.0-dev3 or >= v3.2.0-dev2, <= v3.2.0-dev2 or >= v3.2.0-dev1, <= v3.2.0-dev1 or >= v3.1.32, <= v3.1.32 or >= v3.1.32-dev2, <= v3.1.32-dev2 or >= v3.1.31, <= v3.1.31 or >= v3.1.30, <= v3.1.30 or >= v3.1.30-dev1, <= v3.1.30-dev1 or >= v3.1.29, <= v3.1.29 or >= v3.1.29-dev3, <= v3.1.29-dev3 or >= v3.1.28, <= v3.1.28 or >= v3.1.28-dev3, <= v3.1.28-dev3 or >= v3.1.28-dev2, <= v3.1.28-dev2 or >= v3.1.27, <= v3.1.27 or >= v3.1.27-dev4, <= v3.1.27-dev4 or >= v3.1.27-dev2, <= v3.1.27-dev2 or >= v3.1.27-dev1, <= v3.1.27-dev1 or >= v3.1.26, <= v3.1.26 or >= v3.1.26-dev3, <= v3.1.26-dev3 or >= v3.1.26-dev2, <= v3.1.26-dev2 or >= v3.1.26-dev1, <= v3.1.26-dev1 or >= v3.1.25, <= v3.1.25 or >= v3.1.25-dev6, <= v3.1.25-dev6 or >= v3.1.25-dev4, <= v3.1.25-dev4 or >= v3.1.25-dev3, <= v3.1.25-dev3 or >= v3.1.24, <= v3.1.24 or >= v3.1.23, <= v3.1.23 or >= v3.1.22, <= v3.1.22 or >= v3.1.22-dev2, <= v3.1.22-dev2 or >= v3.1.22-dev1, <= v3.1.22-dev1 or >= v3.1.21, <= v3.1.21 or >= v3.1.21-dev4, <= v3.1.21-dev4 or >= v3.1.21-dev3, <= v3.1.21-dev3 or >= v3.1.21-dev1, <= v3.1.21-dev1 or >= v3.1.20, <= v3.1.20 or >= v3.1.20-dev4, <= v3.1.20-dev4 or >= v3.1.20-dev3, <= v3.1.20-dev3 or >= v3.1.19, <= v3.1.19 or >= v3.1.19-dev3, <= v3.1.19-dev3 or >= v3.1.18, <= v3.1.18 or >= v3.1.17, <= v3.1.17 or >= v3.1.16, <= v3.1.16 or >= v3.1.15, <= v3.1.15 or >= v3.1.15-dev3, <= v3.1.15-dev3 or >= v3.1.15-dev1, <= v3.1.15-dev1 or >= v3.1.14, <= v3.1.14 or >= v3.1.14-dev2, <= v3.1.14-dev2 or >= v3.1.13, <= v3.1.13 or >= v3.1.12, <= v3.1.12 or >= v3.1.12-dev4, <= v3.1.12-dev4 or >= v3.1.12-dev3, <= v3.1.12-dev3 or >= v3.1.12-dev2, <= v3.1.12-dev2 or >= v3.1.11, <= v3.1.11 or >= v3.1.11-dev9, <= v3.1.11-dev9 or >= v3.1.11-dev5, <= v3.1.11-dev5 or >= v3.1.11-dev2, <= v3.1.11-dev2 or >= v3.1.10, <= v3.1.10 or >= v3.1.10-dev6, <= v3.1.10-dev6 or >= v3.1.10-dev1, <= v3.1.10-dev1 or >= v3.1.9, <= v3.1.9 or >= v3.1.9-dev10, <= v3.1.9-dev10 or >= v3.1.9-dev9, <= v3.1.9-dev9 or >= v3.1.9-dev7, <= v3.1.9-dev7 or >= v3.1.9-dev6, <= v3.1.9-dev6 or >= v3.1.9-dev4, <= v3.1.9-dev4 or >= v3.1.9-dev3, <= v3.1.9-dev3 or >= v3.1.9-dev2, <= v3.1.9-dev2 or >= v3.1.9-dev1, <= v3.1.9-dev1 or >= v3.1.8, <= v3.1.8 or >= v3.1.8-dev3, <= v3.1.8-dev3 or >= v3.1.8-dev2, <= v3.1.8-dev2 or >= v3.1.7, <= v3.1.7 or >= v3.1.7-dev8, <= v3.1.7-dev8 or >= v3.1.7-dev7, <= v3.1.7-dev7 or >= v3.1.7-dev5, <= v3.1.7-dev5 or >= v3.1.7-dev4, <= v3.1.7-dev4 or >= v3.1.7-dev3, <= v3.1.7-dev3 or >= v3.1.6, <= v3.1.6 or >= v3.1.6-dev2, <= v3.1.6-dev2 or >= v3.1.6-dev1, <= v3.1.6-dev1 or >= v3.1.5, <= v3.1.5 or >= v3.1.4, <= v3.1.4 or >= v3.1.4-dev5, <= v3.1.4-dev5 or >= v3.1.4-dev3, <= v3.1.4-dev3 or >= v3.1.4-dev2, <= v3.1.4-dev2 or >= v3.1.3, <= v3.1.3 or >= v3.1.3-dev2, <= v3.1.3-dev2 or >= v3.1.3-dev1, <= v3.1.3-dev1 or >= v3.1.2, <= v3.1.2 or >= v3.1.2-dev4, <= v3.1.2-dev4 or >= v3.1.2-dev3, <= v3.1.2-dev3 or >= v3.1.2-dev2, <= v3.1.2-dev2 or >= v3.1.1-dev2, <= v3.1.1-dev2 or >= v3.1.1-dev1, <= v3.1.1-dev1 or >= v3.1.0, <= v3.1.0 or >= v3.1.0-dev12, <= v3.1.0-dev12 or >= v3.1.0-dev11, <= v3.1.0-dev11 or >= v3.1.0-dev10, <= v3.1.0-dev10 or >= v3.1.0-dev9, <= v3.1.0-dev9 or >= v3.1.0-dev8, <= v3.1.0-dev8 or >= v3.1.0-dev3, <= v3.1.0-dev3 or >= v3.1.0-dev2, <= v3.1.0-dev2 or >= v3.0.17, <= v3.0.17 or >= v3.0.17-dev2, <= v3.0.17-dev2 or >= v3.0.17-dev1, <= v3.0.17-dev1 or >= v3.0.16, <= v3.0.16 or >= v3.0.16-dev3, <= v3.0.16-dev3 or >= v3.0.15, <= v3.0.15 or >= v3.0.15-dev2, <= v3.0.15-dev2 or >= v3.0.15-dev1, <= v3.0.15-dev1 or >= v3.0.14, <= v3.0.14 or >= v3.0.13-dev4, <= v3.0.13-dev4 or >= v3.0.13-dev3, <= v3.0.13-dev3 or >= v3.0.12, <= v3.0.12 or >= v3.0.12-dev5, <= v3.0.12-dev5 or >= v3.0.12-dev4, <= v3.0.12-dev4 or >= v3.0.12-dev1, <= v3.0.12-dev1 or >= v3.0.11, <= v3.0.11 or >= v3.0.10, <= v3.0.10 or >= v3.0.10-dev3, <= v3.0.10-dev3 or >= v3.0.10-dev1, <= v3.0.10-dev1 or >= v3.0.9, <= v3.0.9 or >= v3.0.8, <= v3.0.8 or >= v3.0.8-dev2, <= v3.0.8-dev2 or >= v3.0.8-dev1, <= v3.0.8-dev1 or >= v3.0.7, <= v3.0.7 or >= v3.0.7-dev1, <= v3.0.7-dev1 or >= v3.0.6, <= v3.0.6 or >= v3.0.6-dev3, <= v3.0.6-dev3 or >= v3.0.6-dev2, <= v3.0.6-dev2 or >= v3.0.5, <= v3.0.5 or >= v3.0.5-dev5, <= v3.0.5-dev5 or >= v3.0.5-dev4, <= v3.0.5-dev4 or >= v3.0.5-dev3, <= v3.0.5-dev3 or >= v3.0.4, <= v3.0.4 or >= v3.0.4-dev2, <= v3.0.4-dev2 or >= v3.0.3, <= v3.0.3 or >= v3.0.3-dev5, <= v3.0.3-dev5 or >= v3.0.3-dev4, <= v3.0.3-dev4 or >= v3.0.2, <= v3.0.2 or >= v3.0.2-dev2, <= v3.0.2-dev2 or >= v3.0.1, <= v3.0.1 or >= v3.0.1-dev2, <= v3.0.1-dev2 or >= v3.0.0, <= v3.0.0 or >= v3.0.0-dev2, <= v3.0.0-dev2 or >= v3.0.0-dev1, <= v3.0.0-dev1 or >= v2.12.8, <= v2.12.8 or >= v2.12.8-dev2, <= v2.12.8-dev2 or >= v2.12.7, <= v2.12.7 or >= v2.12.7-dev2, <= v2.12.7-dev2 or >= v2.12.7-dev1, <= v2.12.7-dev1 or >= v2.12.6, <= v2.12.6 or >= v2.12.5, <= v2.12.5 or >= v2.12.4, <= v2.12.4 or >= v2.12.4-dev2, <= v2.12.4-dev2 or >= v2.12.3, <= v2.12.3 or >= v2.12.3-dev2, <= v2.12.3-dev2 or >= v2.12.2, <= v2.12.2 or >= v2.12.1, <= v2.12.1 or >= v2.12.1-dev3, <= v2.12.1-dev3 or >= v2.12.0, <= v2.12.0 or >= v2.12.0-dev1, <= v2.12.0-dev1 or >= v2.11.4, <= v2.11.4 or >= v2.11.4-dev6, <= v2.11.4-dev6 or >= v2.11.4-dev5, <= v2.11.4-dev5 or >= v2.11.4-dev4, <= v2.11.4-dev4 or >= v2.11.4-dev2, <= v2.11.4-dev2 or >= v2.11.3, <= v2.11.3 or >= v2.11.3-dev2, <= v2.11.3-dev2 or >= v2.11.3-dev1, <= v2.11.3-dev1 or >= v2.11.2, <= v2.11.2 or >= v2.11.2-dev5, <= v2.11.2-dev5 or >= v2.11.2-dev4, <= v2.11.2-dev4 or >= v2.11.2-dev3, <= v2.11.2-dev3 or >= v2.11.2-dev2, <= v2.11.2-dev2 or >= v2.11.2-dev1, <= v2.11.2-dev1 or >= v2.11.1, <= v2.11.1 or >= v2.11.1-dev1, <= v2.11.1-dev1 or >= v2.11.0, <= v2.11.0 or >= v2.11.0-dev2, <= v2.11.0-dev2 or >= v2.10.16, <= v2.10.16 or >= v2.10.16-dev2, <= v2.10.16-dev2 or >= v2.10.15, <= v2.10.15 or >= v2.10.15-dev1, <= v2.10.15-dev1 or >= v2.10.14, <= v2.10.14 or >= v2.10.14-dev2, <= v2.10.14-dev2 or >= v2.10.14-dev1, <= v2.10.14-dev1 or >= v2.10.13, <= v2.10.13 or >= v2.10.13-dev5, <= v2.10.13-dev5 or >= v2.10.13-dev1, <= v2.10.13-dev1 or >= v2.10.12, <= v2.10.12 or >= v2.10.12-dev1, <= v2.10.12-dev1 or >= v2.10.11, <= v2.10.11 or >= v2.10.11-dev2, <= v2.10.11-dev2 or >= v2.10.10, <= v2.10.10 or >= v2.10.9, <= v2.10.9 or >= v2.10.9-dev3, <= v2.10.9-dev3 or >= v2.10.8, <= v2.10.8 or >= v2.10.8-dev3, <= v2.10.8-dev3 or >= v2.10.8-dev2, <= v2.10.8-dev2 or >= v2.10.8-dev1, <= v2.10.8-dev1 or >= v2.10.6, <= v2.10.6 or >= v2.10.6-dev4, <= v2.10.6-dev4 or >= v2.10.6-dev3, <= v2.10.6-dev3 or >= v2.10.6-dev2, <= v2.10.6-dev2 or >= v2.10.6-dev1, <= v2.10.6-dev1 or >= v2.10.5, <= v2.10.5 or >= v2.10.5-dev2, <= v2.10.5-dev2 or >= v2.10.5-dev1, <= v2.10.5-dev1 or >= v2.10.4, <= v2.10.4 or >= v2.10.4-dev1, <= v2.10.4-dev1 or >= v2.10.3, <= v2.10.3 or >= v2.10.3-dev3, <= v2.10.3-dev3 or >= v2.10.3-dev2, <= v2.10.3-dev2 or >= v2.10.3-dev1, <= v2.10.3-dev1 or >= v2.10.2, <= v2.10.2 or >= v2.10.1, <= v2.10.1 or >= v2.10.1-dev1, <= v2.10.1-dev1 or >= v2.10.0, <= v2.10.0 or >= v2.9.9, <= v2.9.9 or >= v2.9.9-dev1, <= v2.9.9-dev1 or >= v2.9.8, <= v2.9.8 or >= v2.9.8-dev2, <= v2.9.8-dev2 or >= v2.9.8-dev1, <= v2.9.8-dev1 or >= v2.9.7, <= v2.9.7 or >= v2.9.7-dev3, <= v2.9.7-dev3 or >= v2.9.7-dev2, <= v2.9.7-dev2 or >= v2.9.6, <= v2.9.6 or >= v2.9.6-dev1, <= v2.9.6-dev1 or >= v2.9.5, <= v2.9.5 or >= v2.9.5-dev2, <= v2.9.5-dev2 or >= v2.9.4, <= v2.9.4 or >= v2.9.4-dev2, <= v2.9.4-dev2 or >= v2.9.3, <= v2.9.3 or >= v2.9.3-dev3, <= v2.9.3-dev3 or >= v2.9.3-dev1, <= v2.9.3-dev1 or >= v2.9.2, <= v2.9.2 or >= v2.9.2-dev3, <= v2.9.2-dev3 or >= v2.9.2-dev2, <= v2.9.2-dev2 or >= v2.9.1, <= v2.9.1 or >= v2.9.1-dev2, <= v2.9.1-dev2 or >= v2.9.1-dev1, <= v2.9.1-dev1 or >= v2.9.0, <= v2.9.0 or >= v2.9.0-dev1, <= v2.9.0-dev1 or >= v2.8.10, <= v2.8.10 or >= v2.8.9, <= v2.8.9 or >= v2.8.9-dev3, <= v2.8.9-dev3 or >= v2.8.9-dev2, <= v2.8.9-dev2 or >= v2.8.8, <= v2.8.8 or >= v2.8.8-dev3, <= v2.8.8-dev3 or >= v2.8.8-dev1, <= v2.8.8-dev1 or >= v2.8.7, <= v2.8.7 or >= v2.8.7-dev5, <= v2.8.7-dev5 or >= v2.8.7-dev3, <= v2.8.7-dev3 or >= v2.8.7-dev2, <= v2.8.7-dev2 or >= v2.8.6, <= v2.8.6 or >= v2.8.6-dev4, <= v2.8.6-dev4 or >= v2.8.6-dev2, <= v2.8.6-dev2 or >= v2.8.6-dev1, <= v2.8.6-dev1 or >= v2.8.5, <= v2.8.5 or >= v2.8.5-dev3, <= v2.8.5-dev3 or >= v2.8.5-dev2, <= v2.8.5-dev2 or >= v2.8.5-dev1, <= v2.8.5-dev1 or >= v2.8.4, <= v2.8.4 or >= v2.8.4-dev2, <= v2.8.4-dev2 or >= v2.8.3, <= v2.8.3 or >= v2.8.3-dev1, <= v2.8.3-dev1 or >= v2.8.1-dev3, <= v2.8.1-dev3 or >= v2.8.1-dev2, <= v2.8.1-dev2 or >= v2.8.1-dev1, <= v2.8.1-dev1 or >= v2.8.0, <= v2.8.0 or >= v2.8.0-dev1, <= v2.8.0-dev1 or >= v2.7.10, <= v2.7.10 or >= v2.7.9-dev2, <= v2.7.9-dev2 or >= v2.7.9-dev1, <= v2.7.9-dev1 or >= v2.7.9, <= v2.7.9 or >= v2.7.8, <= v2.7.8 or >= v2.7.8-dev1, <= v2.7.8-dev1 or >= v2.7.7, <= v2.7.7 or >= v2.7.7-dev4, <= v2.7.7-dev4 or >= v2.7.7-dev3, <= v2.7.7-dev3 or >= v2.7.7-dev2, <= v2.7.7-dev2 or >= v2.7.7-dev1, <= v2.7.7-dev1 or >= v2.7.6, <= v2.7.6 or >= v2.7.6-dev4, <= v2.7.6-dev4 or >= v2.7.6-dev3, <= v2.7.6-dev3 or >= v2.7.5, <= v2.7.5 or >= v2.7.5-dev2, <= v2.7.5-dev2 or >= v2.7.4, <= v2.7.4 or >= v2.7.4-dev1, <= v2.7.4-dev1 or >= v2.7.3, <= v2.7.3 or >= v2.7.3-dev4, <= v2.7.3-dev4 or >= v2.7.3-dev3, <= v2.7.3-dev3 or >= v2.7.2, <= v2.7.2 or >= v2.7.2-dev3, <= v2.7.2-dev3 or >= v2.7.2-dev2, <= v2.7.2-dev2 or >= v2.7.2-dev1, <= v2.7.2-dev1 or >= v2.7.1, <= v2.7.1 or >= v2.7.1-dev5, <= v2.7.1-dev5 or >= v2.7.1-dev1, <= v2.7.1-dev1 or >= v2.7.0, <= v2.7.0 or >= v2.6.3, <= v2.6.3 or >= v2.6.3-dev6, <= v2.6.3-dev6 or >= v2.6.3-dev4, <= v2.6.3-dev4 or >= v2.6.3-dev3, <= v2.6.3-dev3 or >= v2.6.3-dev2, <= v2.6.3-dev2 or >= v2.6.3-dev1, <= v2.6.3-dev1 or >= v2.6.2, <= v2.6.2 or >= v2.6.1, <= v2.6.1 or >= v2.6.1-dev7, <= v2.6.1-dev7 or >= v2.6.1-dev6, <= v2.6.1-dev6 or >= v2.6.1-dev5, <= v2.6.1-dev5 or >= v2.6.1-dev4, <= v2.6.1-dev4 or >= v2.6.1-dev3, <= v2.6.1-dev3 or >= v2.6.0, <= v2.6.0 or >= v2.6.0-dev3, <= v2.6.0-dev3 or >= v2.6.0-dev2, <= v2.6.0-dev2 or >= v2.6.0-dev1, <= v2.6.0-dev1 or >= v2.5.5, <= v2.5.5 or >= v2.5.5-dev1, <= v2.5.5-dev1 or >= v2.5.4, <= v2.5.4 or >= v2.5.4-dev1, <= v2.5.4-dev1 or >= v2.5.3, <= v2.5.3 or >= v2.5.3-dev2, <= v2.5.3-dev2 or >= v2.5.2, <= v2.5.2 or >= v2.5.2-dev2, <= v2.5.2-dev2 or >= v2.5.1, <= v2.5.1 or >= v2.5.1-dev2, <= v2.5.1-dev2 or >= v2.5.1-dev1, <= v2.5.1-dev1 or >= v2.5.0, <= v2.5.0 or >= v2.5.0-dev2, <= v2.5.0-dev2 or >= v2.5.0-dev1, <= v2.5.0-dev1 or >= v2.4.12, <= v2.4.12 or >= v2.4.12-dev2, <= v2.4.12-dev2 or >= v2.4.11, <= v2.4.11 or >= v2.4.10, <= v2.4.10 or >= v2.4.9, <= v2.4.9 or >= v2.4.8, <= v2.4.8 or >= v2.4.7, <= v2.4.7 or >= v2.4.6, <= v2.4.6 or >= v2.4.5, <= v2.4.5 or >= v2.4.4, <= v2.4.4 or >= v2.4.3, <= v2.4.3 or >= v2.4.2, <= v2.4.2 or >= v2.4.1, <= v2.4.1 or >= v2.4.0, <= v2.4.0 or >= v2.3.3, <= v2.3.3 or >= v2.3.2, <= v2.3.2 or >= v2.3.1, <= v2.3.1 or >= v2.3.0, <= v2.3.0 or >= v2.2.3, <= v2.2.3 or >= v2.2.2, <= v2.2.2 or >= v2.2.1, <= v2.2.1 or >= v2.2.0, <= v2.2.0 or >= v2.1.14, <= v2.1.14 or >= v2.1.13, <= v2.1.13 or >= v2.1.12, <= v2.1.12 or >= v2.1.11, <= v2.1.11 or >= v2.1.10, <= v2.1.10 or >= v2.1.9, <= v2.1.9 or >= v2.1.8, <= v2.1.8 or >= v2.1.8-dev1, <= v2.1.8-dev1 or >= v2.1.7, <= v2.1.7 or >= v2.1.6, <= v2.1.6 or >= v2.1.6-dev1, <= v2.1.6-dev1 or >= v2.1.5, <= v2.1.5 or >= v2.1.4, <= v2.1.4 or >= v2.1.3, <= v2.1.3 or >= v2.1.3-dev1, <= v2.1.3-dev1 or >= v2.1.2, <= v2.1.2 or >= v2.1.1, <= v2.1.1 or >= v2.1.0, <= v2.1.0 or >= v2.0.27, <= v2.0.27 or >= v2.0.26, <= v2.0.26 or >= v2.0.26-dev2, <= v2.0.26-dev2 or >= v2.0.26-dev1, <= v2.0.26-dev1 or >= v2.0.25, <= v2.0.25 or >= v2.0.24, <= v2.0.24 or >= v2.0.23, <= v2.0.23 or >= v2.0.22, <= v2.0.22 or >= v2.0.21, <= v2.0.21 or >= v2.0.21-dev1, <= v2.0.21-dev1 or >= v2.0.20, <= v2.0.20 or >= v2.0.19, <= v2.0.19 or >= v2.0.18, <= v2.0.18 or >= v2.0.17, <= v2.0.17 or >= dev2.0.17-2, <= dev2.0.17-2 or >= v2.0.16, <= v2.0.16 or >= v2.0.15, <= v2.0.15 or >= v2.0.14, <= v2.0.14 or >= v2.0.13, <= v2.0.13 or >= v2.0.12, <= v2.0.12 or >= v2.0.11, <= v2.0.11 or >= v2.0.10, <= v2.0.10 or >= v2.0.9, <= v2.0.9 or >= v2.0.8, <= v2.0.8 or >= v2.0.7, <= v2.0.7 or >= v2.0.6, <= v2.0.6 or >= v2.0.5, <= v2.0.5 or >= v2.0.4, <= v2.0.4 or >= v2.0.3, <= v2.0.3 or >= v2.0.2, <= v2.0.2 or >= v2.0.1, <= v2.0.1 or >= v2.0.0, <= v2.0.0 or >= v2.0.0-beta2, <= v2.0.0-beta2 or >= v2.0.0-beta1, <= v2.0.0-beta1 or >= v1.9.9, <= v1.9.9 or >= v1.9.8, <= v1.9.8 or >= v1.9.7, <= v1.9.7 or >= v1.9.6, <= v1.9.6 or >= v1.9.5, <= v1.9.5 or >= v1.9.4, <= v1.9.4 or >= v1.9.3, <= v1.9.3 or >= v1.9.2, <= v1.9.2 or >= v1.9.1, <= v1.9.1 or >= v1.9.0, <= v1.9.0 or >= v1.8.9, <= v1.8.9 or >= v1.8.8, <= v1.8.8 or >= v1.8.7, <= v1.8.7 or >= v1.8.6, <= v1.8.6 or >= v1.8.5, <= v1.8.5 or >= v1.8.4, <= v1.8.4 or >= v1.8.2, <= v1.8.2 or >= v1.8.1, <= v1.8.1 or >= v1.8.0, <= v1.8.0 or >= v1.7.11, <= v1.7.11 or >= v1.7.10, <= v1.7.10 or >= v1.7.9, <= v1.7.9 or >= v1.7.8, <= v1.7.8 or >= v1.7.7, <= v1.7.7 or >= v1.7.6, <= v1.7.6 or >= v1.7.5, <= v1.7.5 or >= v1.7.4, <= v1.7.4 or >= v1.7.3, <= v1.7.3 or >= v1.7.2, <= v1.7.2 or >= v1.7.1, <= v1.7.1 or >= v1.7.0, <= v1.7.0 or >= v1.6.3, <= v1.6.3 or >= v1.6.2, <= v1.6.2 or >= v1.6.1, <= v1.6.1 or >= v1.6.0, <= v1.6.0 or >= v1.5.6, <= v1.5.6 or >= v1.5.5, <= v1.5.5 or >= v1.5.5-beta3, <= v1.5.5-beta3 or >= v1.5.5-beta2, <= v1.5.5-beta2 or >= v1.5.5-beta1, <= v1.5.5-beta1 or >= v1.5.4, <= v1.5.4 or >= v1.5.3, <= v1.5.3 or >= v1.5.2, <= v1.5.2 or >= v1.5.1, <= v1.5.1 or >= v1.5.0, <= v1.5.0 or >= v1.4.8, <= v1.4.8 or >= v1.4.7, <= v1.4.7 or >= v1.4.6, <= v1.4.6 or >= v1.4.5, <= v1.4.5 or >= v1.4.4, <= v1.4.4 or >= v1.4.3, <= v1.4.3 or >= v1.4.2, <= v1.4.2 or >= v1.4.1, <= v1.4.1 or >= v1.4.0, <= v1.4.0 or >= v1.3.9, <= v1.3.9 or >= v1.3.8, <= v1.3.8 or >= v1.3.7, <= v1.3.7 or >= v1.3.6, <= v1.3.6 or >= v1.3.5, <= v1.3.5 or >= v1.3.4, <= v1.3.4 or >= v1.3.3, <= v1.3.3 or >= v1.3.2, <= v1.3.2 or >= v1.3.1, <= v1.3.1 or >= v1.3.0, <= v1.3.0 or >= v1.2.9, <= v1.2.9 or >= v1.2.8, <= v1.2.8 or >= v1.2.7, <= v1.2.7 or >= v1.2.6, <= v1.2.6 or >= v1.2.5, <= v1.2.5 or >= v1.2.31, <= v1.2.31 or >= v1.2.3, <= v1.2.3 or >= v1.2.2, <= v1.2.2 or >= v1.2.1, <= v1.2.1 or >= v1.2.0, <= v1.2.0 or >= v1.2.0-rc3, <= v1.2.0-rc3 or >= v1.2.0-rc2, <= v1.2.0-rc2 or >= v1.2.0-rc1, <= v1.2.0-rc1 or >= v1.2.0-beta16, <= v1.2.0-beta16 or >= v1.2.0-beta15, <= v1.2.0-beta15 or >= v1.2.0-beta14, <= v1.2.0-beta14 or >= v1.2.0-beta13, <= v1.2.0-beta13 or >= v1.2.0-beta12, <= v1.2.0-beta12 or >= v1.2.0-beta11, <= v1.2.0-beta11 or >= v1.2.0-beta10, <= v1.2.0-beta10 or >= v1.2.0-beta9, <= v1.2.0-beta9 or >= v1.2.0-beta8, <= v1.2.0-beta8 or >= v1.2.0-beta7, <= v1.2.0-beta7 or >= v1.2.0-beta6, <= v1.2.0-beta6 or >= v1.2.0-beta5, <= v1.2.0-beta5 or >= v1.2.0-beta4, <= v1.2.0-beta4 or >= v1.2.0-beta3, <= v1.2.0-beta3 or >= v1.2.0-beta2, <= v1.2.0-beta2 or >= v1.2.0-beta1, <= v1.2.0-beta1 or >= v1.1.83, <= v1.1.83 or >= v1.1.82, <= v1.1.82 or >= v1.1.81, <= v1.1.81 or >= v1.1.8, <= v1.1.8 or >= v1.1.7, <= v1.1.7 or >= v1.1.6, <= v1.1.6 or >= v1.1.5, <= v1.1.5 or >= v1.1.4, <= v1.1.4 or >= v1.1.3, <= v1.1.3 or >= v1.1.2, <= v1.1.2 or >= v1.1.1, <= v1.1.1 or >= v1.1.0, <= v1.1.0 or >= v1.0.9, <= v1.0.9 or >= v1.0.8, <= v1.0.8 or >= v1.0.7, <= v1.0.7 or >= v1.0.6, <= v1.0.6 or >= v1.0.5, <= v1.0.5 or >= v1.0.4, <= v1.0.4 or >= v1.0.3, <= v1.0.3 or >= v1.0.2, <= v1.0.2 or >= v1.0.1, <= v1.0.1 or >= v1.0.0, <= v1.0.0 or >= v0.9.9, <= v0.9.9 or >= v0.9.8, <= v0.9.8 or >= v0.9.7, <= v0.9.7 or >= v0.9.6, <= v0.9.6 or >= v0.9.5, <= v0.9.5 or >= v0.9.2, <= v0.9.2 or >= v0.9.0, <= v0.9.0 or >= v0.8.5, <= v0.8.5 or >= v0.8.0, <= v0.8.0 or >= v0.7.8, <= v0.7.8 or >= v0.7.5, <= v0.7.5 or >= v0.7.1, <= v0.7.1 or >= v0.7.0, <= v0.7.0 or >= v0.6.8, <= v0.6.8 or >= v0.6.7, <= v0.6.7 or >= v0.6.6, <= v0.6.6 or >= v0.6.5, <= v0.6.5 or >= v0.6.4, <= v0.6.4 or >= v0.6.3, <= v0.6.3 or >= v0.6.2, <= v0.6.2 or >= v0.6.1, <= v0.6.1 or >= v0.6.0, <= v0.6.0 or >= v0.5.9, <= v0.5.9 or >= v0.5.8, <= v0.5.8 or >= v0.5.7, <= v0.5.7 or >= v0.5.6, <= v0.5.6 or >= v0.5.6-alpha1, <= v0.5.6-alpha1 or >= v0.5.5, <= v0.5.5 or >= v0.5.46, <= v0.5.46 or >= v0.5.45, <= v0.5.45 or >= v0.5.44, <= v0.5.44 or >= v0.5.43, <= v0.5.43 or >= v0.5.42, <= v0.5.42 or >= v0.5.41, <= v0.5.41 or >= v0.5.4, <= v0.5.4 or >= v0.5.3, <= v0.5.3 or >= v0.5.2, <= v0.5.2 or >= v0.5.1, <= v0.5.1 or >= v0.5.0, <= v0.5.0 or >= v0.4.94, <= v0.4.94 or >= v0.4.93, <= v0.4.93 or >= v0.4.92, <= v0.4.92 or >= v0.4.91, <= v0.4.91 or >= v0.4.9, <= v0.4.9 or >= v0.4.8, <= v0.4.8 or >= v0.4.7, <= v0.4.7 or >= v0.4.6, <= v0.4.6 or >= v0.4.5, <= v0.4.5 or >= v0.4.4, <= v0.4.4 or >= v0.4.32, <= v0.4.32 or >= v0.4.3-x1, <= v0.4.3-x1 or >= v0.4.3, <= v0.4.3 or >= v0.4.2, <= v0.4.2 or >= v0.4.1-x2, <= v0.4.1-x2 or >= v0.4.1, <= v0.4.1 or >= v0.4.0, <= v0.4.0 or >= v0.3.9, <= v0.3.9 or >= v0.3.8, <= v0.3.8 or >= v0.3.7, <= v0.3.7 or >= v0.3.6, <= v0.3.6 or >= v0.3.5, <= v0.3.5 or >= v0.3.4, <= v0.3.4 or >= v0.3.3, <= v0.3.3 or >= v0.3.2, <= v0.3.2 or >= v0.3.1, <= v0.3.1 or >= v0.3.0, <= v0.3.0 or >= v0.2.9, <= v0.2.9 or >= v0.2.8, <= v0.2.8 or >= v0.2.7, <= v0.2.7 or >= v0.2.6, <= v0.2.6 or >= v0.2.5, <= v0.2.5 or >= v0.2.4, <= v0.2.4 or >= v0.2.3, <= v0.2.3 or >= v0.2.2, <= v0.2.2 or >= v0.2.1, <= v0.2.1 or >= v0.2.0, <= v0.2.0 or >= v0.1.9, <= v0.1.9 or >= v0.1.8, <= v0.1.8 or >= v0.1.7, <= v0.1.7 or >= v0.1.6, <= v0.1.6 or >= v0.1.5, <= v0.1.5 or >= v0.1.4, <= v0.1.4 or >= v0.1.3, <= v0.1.3 or >= v0.1.2, <= v0.1.2 or >= v0.1.1, <= v0.1.1 or >= v0.1.0, <= v0.1.0
- Patched version
- Not yet available
CVE-2026-30869GHSA-275H-V5H9-VR82GHSA-P4M3-MGMM-C664
The Siyuan Go package has an authenticated path traversal vulnerability that leaks secrets from conf/conf.json and siyuan.db. Versions up to and including v3.6.5 are affected.
What happened
An authenticated path traversal vulnerability has been identified in the Siyuan Go package. This vulnerability, tracked as CVE-2026-30869, GHSA-275H-V5H9-VR82, and GHSA-P4M3-MGMM-C664, allows unauthorized access to sensitive information stored in conf/conf.json and siyuan.db. The vulnerability is present in the /snippets/*filepath route handler.
The vulnerability was first flagged on 2026-09-02T14:17:44+00:00. It has not been exploited in the wild as of the latest reports. The affected versions span a wide range, from v0.1.0 to v3.6.5, including all development versions within this range.
What to do about it
- Check your Siyuan Go package version against the affected range provided in the threat data.
- If you are using a version within the affected range, upgrade to a version where the vulnerability is fixed if available.
- If no official fix has been published yet, apply a workaround if possible to mitigate the risk.
- Monitor the primary sources for updates on the vulnerability and any available patches.
How 0Day would have caught this
MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using a version of the Siyuan Go package from v0.1.0 to v3.6.5, including all development versions within this range.
What should I do right now?
Check your current version against the affected range. If you are using an affected version, upgrade to a fixed version or apply a workaround if available. Monitor the primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the primary sources for updates on any available patches.