CVE-2026-33669 PUBLISHED

SiYuan has Arbitrary Document Reading within the Publishing Service

Assigner: GitHub_M
Reserved: 23.03.2026 Published: 26.03.2026 Updated: 26.03.2026

SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6.2 patches the issue.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	siyuan-note
Product	siyuan
Versions	Version < 3.6.2 is affected

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-34xj-66v3-6j83

Problem Types

CWE-125: Out-of-bounds Read CWE