CVE-2026-33476 Scanner

SiYuan is a personal knowledge management system used primarily by individuals and small organizations to effectively manage and access a wide array of information. It is designed to handle extensive documentation, personal notes, and collaborative features, making it widely deployed in educational, research, and professional environments. SiYuan is valued for its rich plugin ecosystem and customizable interface, allowing users to tailor the software to their specific knowledge management needs. It is usually installed on personal devices or hosted on servers for team access. Open-source by nature, SiYuan encourages community-driven development and adaptations catering to niche requirements. Emphasizing simplicity and efficiency, it has gained a substantial user base in various knowledge-centric domains.

The Path Traversal vulnerability in SiYuan allows attackers to exploit a file-serving endpoint without authorization. This allows unauthorized access to arbitrary files within the system directories. By bypassing authentication checks, the vulnerability exposes critical information stored on the server. Exploitation is done through crafted URLs, manipulating path navigation to traverse directories. As such, this flaw compels system administrators to secure file access and enforce strict path validations. The affected versions are highly susceptible until version 3.6.2, which patches this vital security lapse and strengthens the software's reliability against unauthorized access.

This vulnerability arises from improper input sanitization within the file-serving endpoint `/appearance/*filepath`. When exploited, it permits directory traversal using specially crafted file paths that navigate to system files outside the intended directory. The unprotected endpoint under the `/appearance` path grants file access regardless of authentication status, thus posing a significant risk for systems running vulnerable versions of SiYuan. Technical details showcase how attackers can send HTTP requests that exploit directory traversal to retrieve sensitive configurations. Effective mitigation requires updating to the secured version 3.6.2, which addresses the root cause by eliminating unauthorized access capabilities.

Exploiting the Path Traversal vulnerability enables attackers to access sensitive files that might contain confidential configurations or personal data. This unauthorized access can lead to data breaches, potentially leaking user credentials, sensitive documents, and proprietary information. By reading arbitrary files, attackers gain insights into user activity, system settings, and possibly even execute further attacks using the information captured. If not remediated, the vulnerability could facilitate extensive unauthorized surveillance and data theft scenarios, undermining user trust and system integrity.

REFERENCES

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7
• https://github.com/siyuan-note/siyuan/commit/009bb598b3beccc972aa5f1ed88b3b224326bf2a
• https://nvd.nist.gov/vuln/detail/CVE-2026-33476