GitStock

the-40-thieves/obsidian-tc · Security

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

GHSA ID
GHSA-cvp8-vvgf-69q4
CVE ID
CVE-2026-77364
Severity
medium
Published
Updated
CVSS
6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v3
6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Impact

With a default configuration, an undefined readPaths/writePaths meant allow-all, the strictReadDefault flag was inert, and the .obsidian/.git/.trash control directories were denied only during enumeration — not on the direct request path. A caller could read .obsidian/plugins/*/data.json, exfiltrating plugin API keys and Obsidian Sync passwords (live-reproduced), as well as any other in-vault file by path.

Patches

Fixed in 1.3.1. Upgrade to >= 1.3.1. The default now denies .obsidian/.git/.trash on read/write/delete and honors strictReadDefault on the request path.

Workarounds

Set an explicit readPaths/writePaths whitelist that excludes the control directories.

CWEs

  • CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-276 · Incorrect Default Permissions

References

Open GitHub