SiYuan before version 3.7.2 contains a path traversal flaw in the /export/temp/ shortcut route of serveExport. An attacker who has authenticated access can craft a request that includes percent‑encoded traversal sequences, such as %2e%2e, which are decoded to '..'. The application then joins the decoded path with the temporary directory without performing sub‑path or sensitivity checks, allowing the victim to read any file under the server’s filesystem. This can expose sensitive configuration files, SSH keys, database and log files, as well as system files like /etc/passwd, thereby compromising confidentiality and potentially enabling further attacks if credentials are obtained.

The vulnerability affects the Siyuan Note application (siyuan-note:siyuan). All releases prior to v3.7.2 are impacted. No specific minor releases are listed; follow the vendor advisory for version details.

The issue has a CVSS v3.1 score of 7.1, indicating high severity, but the EPSS score is below 1%, suggesting that the probability of active exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. An authenticated attacker can remotely trigger the flaw via HTTP requests to /export/temp/, so the attack vector is remote. Because the flaw allows reading arbitrary files, it could be a stepping stone to further credential‑based attacks if sensitive credentials are exposed.