NPM · AUGUST 2026 · EARLY WARNING

SiYuan Path Traversal Vulnerability: Critical CVE-2026-77086 Alert

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: CRITICAL
CVSS: 9.1
Affected component: siyuan (npm)
Patched version: 3.7.4

CVE-2026-77086

An early warning has been issued for a critical vulnerability in SiYuan versions before 3.7.4, which allows authenticated administrators to perform path traversal attacks.

What happened

SiYuan before version 3.7.4 reportedly fails to validate the packageName parameter in Bazaar install and uninstall endpoints. This oversight allows authenticated administrators to execute path traversal attacks by supplying crafted packageName values. Attackers with admin access can write arbitrary files to any location or recursively delete directories, leading to potential system compromise.

The vulnerability, tracked as CVE-2026-77086, was first flagged on 2026-08-21T11:17:06.063000+00:00. It has a CVSS score of 9.1, indicating a critical severity level. The issue has not been reported as exploited in the wild, but the potential impact is significant due to the ability of attackers to manipulate system files and directories.

What to do about it

Upgrade SiYuan to version 3.7.4 or later to mitigate the path traversal vulnerability.
Review your system for any unauthorized changes or deletions that may have occurred prior to applying the patch.
Ensure that only trusted individuals have administrative access to your SiYuan installation to prevent exploitation of this vulnerability.
Monitor the primary sources for any updates or additional information related to CVE-2026-77086.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using SiYuan version 3.7.3 or earlier, you are affected by this vulnerability.

What should I do right now?

Immediately upgrade to SiYuan version 3.7.4 or later to protect against this vulnerability.

Is there an official fix available?

Yes, SiYuan version 3.7.4 has been released to address this vulnerability.

Sources

[CVE-2026-77086] CVSS 9.1 CRITICAL

Join the 0Day waitlist →

← Back to all threats