Evidence · DiggingBeagle record
Obsidian-TC fail-open vault file permissions GHSA-cvp8-vvgf-69q4
Maintainer disclosure of direct-path reads of sensitive plugin configuration despite enumeration filters; resolved in 1.3.1.
- Published
- Jul 3, 2026
- Source role
- primary disclosure
Evidence record
Maintainer disclosure of direct-path reads of sensitive plugin configuration despite enumeration filters; resolved in 1.3.1.
Claim-level citations (2)
- supportsObsidian-TC allowed direct file requests for hidden credential-bearing vault paths: Obsidian-TC before 1.3.1 denied sensitive vault directories in listings but not direct paths, and the maintainer reproduced reading plugin keys and Sync passwords.
Impact; default readPaths/writePaths, strictReadDefault, and reproduced plugins/*/data.json reads
- supportsObsidian-TC allowed direct file requests for hidden credential-bearing vault paths: The 1.3.1 fix applies control-directory denials on direct file read/write/delete and restores strictReadDefault enforcement.
Patches; Workarounds