PT-2026-71238

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An access control bypass exists in the server mux where several static-file routes bypass the publish-access controls enforced on the REST API. This allows attackers with publish reader tokens or...

CVE-2026-34523

SillyTavern (pre-1.17.0) had a path traversal flaw in the static file route handler that allowed unauthenticated users to check for the existence of files on the server by sending percent-encoded ../ sequences. The vulnerability hinges on decoding the request, using fs.existsSync to test path exi...

CVE-2026-34523 SillyTavern: Path traversal allows file existence oracle

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in the static file route handler allows any unauthenticate...

CVE-2026-34523: Improper Limitation of a Pathname to a Restricted Directory

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in the static file route handler allows any unauthenticate...