SiYuan contains a path traversal flaw in the /snippets/ static handler that concatenates a client‑supplied path with the snippets directory without containment checks. An authenticated user can request paths such as /snippets/%2e%2e/%2e%2e/conf/conf.json, which results in the server returning sensitive configuration data (conf.json) and the SQLite database file (siyuan.db). The weakness is a classic path traversal vulnerability (CWE of confidential information.

The issue affects the Siyuan Note application, any instance running a version older than 3.7.1. Versions 3.7.1 and later contain the fix that removes unsafe path handling for the /snippets/ route.

The CVSS score of 7.7 classifies this flaw as High severity, but the EPSS score of less than 1% indicates a low exploitation probability. Because the flaw requires authentication, an attacker must first obtain valid credentials. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. In environments with weak authentication or shared accounts, the remediation.