Vulnerability details

CVE-2026-33476

siyuan-note siyuan

SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal

CVSS 3.1

7.5High

Official description

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected products

Vendor	Product	Versions	Source
siyuan-note	siyuan	< 3.6.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/siyuan-note/siyuan/commit/009bb598b3beccc972aa5f1ed88b3b224326bf2a x_refsource_MISC
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7 x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-21
Last updated: 2026-03-24
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

3.32%

Probability of exploitation in 30 days

88.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73
External Control of File Name or Path