PT-2026-26210 · Siyuan · Siyuan
Restriction
·
Published
2026-03-18
·
Updated
2026-03-27
·
CVE-2026-33194
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.6.2
Description
SiYuan, a personal knowledge management system, has an issue in the
IsSensitivePath() function within kernel/util/path.go. This function employs a denylist approach to restrict file access, but the denylist is incomplete, failing to block several security-sensitive Linux directories including /opt, /usr, /home, /mnt, and /media. The globalCopyFiles and importStdMd API endpoints rely on this function for path validation, making them susceptible to unauthorized file access. Specifically, the globalCopyFiles endpoint, located at kernel/api/file.go:82, uses IsSensitivePath as its only path validation method. This allows an attacker to potentially read arbitrary files from the unblocked directories, including application source code, configurations, and mounted secrets, particularly in Docker deployments. The denylist approach is fundamentally flawed as any newly added filesystem path remains accessible until explicitly blocked.Recommendations
Versions prior to 3.6.2 should be updated to version 3.6.2 or later. Switch from a denylist to an allowlist approach, permitting copying only from the workspace directory and explicitly approved external paths.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Siyuan