CVE-2026-116171

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix \?\ survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to cop...

EUVD-2026-109432

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix \?\ survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to cop...

PT-2026-123012

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix ? survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy...

CVE-2026-108723

answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external...

GO-2026-4708 SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes in github.com/siyuan-note/siyuan

SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes in github.com/siyuan-note/siyuan...

SiYuan security vulnerabilities

SiYuan is a privacy-oriented personal knowledge management system developed by SiYuan itself. Versions of SiYuan 3.6.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from insufficient path validation for the localPath parameter, which could allow non-administrator...

CVE-2026-32750: Improper Limitation of a Pathname to a Restricted Directory

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importStdMd passes the localPath parameter directly to model.ImportFromLocalPath with zero path validation. The function recursively reads every file under the given path and permanently stores their...

CVE-2020-20948

An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable...

PT-2023-30410

Name of the Vulnerable Software and Affected Versions Headwind MDM Web panel version 5.22.1 Description The issue allows for Directory Traversal, where the application's API call to move uploaded temporary files to the file directory during the file upload process is vulnerable. This API call use...

jeecg Access Control Error Vulnerability

jeecg is a software application. An intelligent development platform based on a code generator. An Access Control Error vulnerability exists in Jeecg that stems from the product not doing valid validation of input data. An attacker can exploit the vulnerability to access sensitive files by...

CVE-2020-20948

An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable...

CVE-2020-20948

An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable...

Arbitrary file deletion

An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable...

CVE-2020-20948

CVE-2020-20948 affects jeecg v3.8, enabling arbitrary file download by modifying the localPath variable. The vulnerability stems from insufficient input validation/Access Control, allowing an attacker to access sensitive files. Exploitation status is not documented in the provided sources; no pat...

CVE-2020-20948

An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable...

CVE-2020-20948: Exposure of Resource to Wrong Sphere

An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable...

PT-2021-10559

Name of the Vulnerable Software and Affected Versions: jeecg version 3.8 Description: The issue allows attackers to access sensitive files by modifying the localPath variable, potentially leading to unauthorized access to sensitive information. Recommendations: For jeecg version 3.8, consider...

Nconf 1.3 SQL Injection / Cross Site Scripting Vulnerabilities

Nconf version 1.3 suffers from cross site scripting and remote SQL injection vulnerabilities. Exploit Title: nconf handleitem.php，Modifyattr.php etc Multiple Sql injection Date: 2013/3/4 Exploit Author: Saadat Ullah，email protected Software Link: http://sourceforge.net/projects/nconf/files/nconf/...

Nconf 1.3 - Multiple SQL Injections

Nconf 1.3 - Multiple SQL Injections Exploit Title: nconf handleitem.php，Modifyattr.php etc Multiple Sql injection Date: 2013/3/4 Exploit Author: Saadat Ullah，[email protected] Software Link: http://sourceforge.net/projects/nconf/files/nconf/ Vendors: http://www.nconf.org/ Author HomePage:...

Nconf 1.3 SQL Injection / Cross Site Scripting

Exploit Title: nconf handleitem.php，Modifyattr.php etc Multiple Sql injection Date: 2013/3/4 Exploit Author: Saadat Ullah，[email protected] Software Link: http://sourceforge.net/projects/nconf/files/nconf/ Vendors: http://www.nconf.org/ Author HomePage: http://security-geeks.blogspot.com/...