Yank Note: Path traversal via /api/help endpoint
Summary
Yank Note before version 3.93.1 contains a path traversal vulnerability in the /api/help endpoint. The endpoint is on the unauthenticated allowlist, so an unauthenticated remote attacker who can reach the service can read arbitrary files, such as SSH keys, configuration files and notes. The weak sanitization can be bypassed with repeated '../' sequences.
Affected
- Yank Note versions before 3.93.1 (0 to < 3.93.1)
Fixed in
- Yank Note 3.93.1 or later
Workaround
- Unknown. No vendor workaround is documented.
- Until the update is installed, block access to the Yank Note HTTP port from untrusted networks with host firewall rules.
Exploitation
- No known exploitation in the wild. CISA SSVC: exploitation none, not automatable.
- VulDB reports no public exploit. The root cause is publicly described in the issue and fix commit, which may ease exploit development.
Our recommendation
- Identify all Yank Note installations, including on developer and administrator machines.
- Update to version 3.93.1 or later.
- If the service was reachable from outside, review logs for requests to /api/help containing repeated '../' sequences.
- Rotate SSH keys and credentials stored on any host where the vulnerable service was reachable from untrusted networks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (VulnCheck advisory) www.vulncheck.com
- Yank Note release v3.93.1 github.com
- Fix commit d3b0ad2 github.com
- Yank Note issue #543 github.com
- Vulnerable code at v3.93.0 github.com
- VulDB entry 422371 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:45.
Original description (NVD)
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.
NVD references (5)
- https://github.com/purocean/yn/blob/v3.93.0/src/main/server/index.ts
- https://github.com/purocean/yn/commit/d3b0ad27f7f6388b878eefd828557ae2d2a8789b
- https://github.com/purocean/yn/issues/543
- https://github.com/purocean/yn/releases/tag/v3.93.1
- https://www.vulncheck.com/advisories/yank-note-before-3.93.1-path-traversal-via-api-help-endpoint
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.