PT-2026-26210 · Siyuan · Siyuan

Restriction

·

Published

2026-03-18

·

Updated

2026-03-27

·

CVE-2026-33194

CVSS v3.1

6.8

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.2
Description SiYuan, a personal knowledge management system, has an issue in the IsSensitivePath() function within kernel/util/path.go. This function employs a denylist approach to restrict file access, but the denylist is incomplete, failing to block several security-sensitive Linux directories including /opt, /usr, /home, /mnt, and /media. The globalCopyFiles and importStdMd API endpoints rely on this function for path validation, making them susceptible to unauthorized file access. Specifically, the globalCopyFiles endpoint, located at kernel/api/file.go:82, uses IsSensitivePath as its only path validation method. This allows an attacker to potentially read arbitrary files from the unblocked directories, including application source code, configurations, and mounted secrets, particularly in Docker deployments. The denylist approach is fundamentally flawed as any newly added filesystem path remains accessible until explicitly blocked.
Recommendations Versions prior to 3.6.2 should be updated to version 3.6.2 or later. Switch from a denylist to an allowlist approach, permitting copying only from the workspace directory and explicitly approved external paths.

Exploit

Fix

Path traversal

Weakness Enumeration

Related Identifiers

CVE-2026-33194
GHSA-VM69-H85X-8P85
GO-2026-4766
SUSE-SU-2026:1135-1

Affected Products

Siyuan