The vulnerability is a path traversal flaw in the exportBrowserHTML endpoint of SiYuan versions before 3.8.4. It lets authenticated administrators send a folder parameter containing traversal sequences to write arbitrary HTML to index.html outside the workspace directory, enabling stored cross‑site scripting or defacement.

The affected product is SiYuan from siyuan-note; any installation older than version 3.8.4 is susceptible. The flaw permits writing index.html in any directory that the workspace process can write to, effectively allowing administrators to modify files outside their own workspace.

The CVSS score of 8.3 signals a high severity vulnerability. EPSS is not available and it is not listed in the CISA KEV catalog. Attackers require administrator credentials and may target the exportBrowserHTML feature to inject malicious content into any writable location, resulting in persistent cross‑site scripting or defacement. Given the administrative access requirement, the threat vector is internal, but once that access is obtained, the impact can be system‑wide.