CVE-2026-33670 PUBLISHED

SiYuan has directory traversal within its publishing service

Assigner: GitHub_M
Reserved: 23.03.2026 Published: 26.03.2026 Updated: 26.03.2026

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. Version 3.6.2 patches the issue.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	siyuan-note
Product	siyuan
Versions	Version < 3.6.2 is affected

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xmw9-6r43-x9ww

Problem Types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE