Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

Fix availableCritical · CVSS 9.3EPSS 1.2%

Published Mar 7, 2026 · updated Nov 5, 2026

What to do

  1. Upgrade to a fixed version: github.com/siyuan-note/siyuan/kernel 3.5.10.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/siyuan-note/siyuan/kernel

Vulnerable versions
<= 3.5.9
Fixed in
3.5.10

Check your project: go list -m all | grep github.com/siyuan-note/siyuan/kernel

Sources

CWE-22 Improper Limitation of a Pathname to a Restricted Directory · CWE-200 Exposure of Sensitive Information to an Unauthorized Actor · CWE-285 Improper Authorization

← All critical vulnerabilities