CVE-2026-33670

CRITICAL

SiYuan has directory traversal within its publishing service

Title source: cna

Description

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. Version 3.6.2 patches the issue.

References (1)

[X_Refsource_Confirm] https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xmw9-6r43-x9ww

Scores

CVSS v3 9.8

EPSS 0.0007

EPSS Percentile 20.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-22

Status published

Products (3)

b3log/siyuan < 3.6.2

siyuan-note/siyuan 0Go

siyuan-note/siyuan < 3.6.2

Published Mar 26, 2026

Tracked Since Mar 27, 2026