PT-2026-35066 · Siyuan Note · Siyuan

Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-41894

Mitre

CVSS v4.0

7.1

High

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did not address the root cause — a redundant url.PathUnescape() call in serveExport(). An authenticated attacker can use double URL encoding (%252e%252e) to traverse directories and read arbitrary workspace files including the full SQLite database (siyuan.db), kernel log, and all user documents. This vulnerability is fixed in 3.6.5.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-41894

Affected Products

Siyuan

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-41894 · Security Note
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hjh7-r5w8-5872 · Note
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.5 · Note
• https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7 · Note
• https://twitter.com/CVEnew/status/2047798570263388531 · Twitter Post