PT-2026-28171 · Siyuan · Siyuan

Congsec

·

Publicado

2026-03-25

·

Atualizado

2026-03-27

·

CVE-2026-33670

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.2
Description SiYuan, a personal knowledge management system, contains a directory traversal issue in the /api/file/readDir interface. This interface was used to retrieve file names under a notebook without proper authorization. An attacker could exploit this to traverse the directory structure and potentially read arbitrary documents. The vulnerability exists due to insufficient restrictions on file access through the API endpoint. The /api/file/readDir API endpoint accepts a path variable that is not adequately validated, allowing for directory traversal.
Recommendations Versions prior to 3.6.2 should be updated to version 3.6.2 or later.

Exploit

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-33670
GHSA-XMW9-6R43-X9WW
GO-2026-4843
SUSE-SU-2026:1135-1

Produtos afetados

Siyuan