PT-2026-35066 · Siyuan · Siyuan

Published 2026-04-22 · Updated 2026-04-24 · CVE-2026-41894

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.5

Description An authenticated attacker can perform directory traversal to read arbitrary workspace files, including the full SQLite database (siyuan.db), kernel logs, and all user documents. This occurs because the serveExport() function contains a redundant url.PathUnescape() call, creating a double-decode vulnerability. By using double URL encoding (such as %252e%252e), an attacker can bypass path cleaning and access sensitive files. While a previous attempt to fix this issue introduced a denylist check via the IsSensitivePath() function, it failed to address the root cause and did not block access to critical files within the workspace temporary directory.

Recommendations Update to version 3.6.5.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41894

GHSA-HJH7-R5W8-5872

Affected Products

Siyuan

References · 8

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hjh7-r5w8-5872 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41894 · Security Note
• https://osv.dev/vulnerability/GHSA-hjh7-r5w8-5872 · Vendor Advisory
• https://github.com/siyuan-note/siyuan · Note
• https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7 · Note
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.5 · Note
• https://twitter.com/CVEnew/status/2047798570263388531 · Twitter Post
• https://github.com/advisories/GHSA-2h2p-mvfx-868w · Note