File Read Vulnerability in SiYuan Personal Knowledge Management System

CVE-2026-32747

What is CVE-2026-32747?

The SiYuan Personal Knowledge Management System has a vulnerability in its globalCopyFiles API, which improperly handles file paths without adequate workspace boundary checks. This flaw allows an admin to access sensitive files, including Docker secrets and environment variables, which can be exfiltrated into the workspace. Such issues predominantly arise in containerized environments, where injected secrets may become accessible through the standard file API. The vulnerability has been addressed in version 3.6.1, emphasizing the need for immediate updates to mitigate potential risks.

References