Local Path Manipulation in SiYuan Personal Knowledge Management System

CVE-2026-32750

What is CVE-2026-32750?

In SiYuan versions 3.6.0 and below, a security vulnerability exists in the POST /api/import/importStdMd endpoint. The localPath parameter is processed without any path validation, allowing unauthorized access to files within the specified directory. This function recursively imports all files found under the given path and stores their contents as searchable notes in the SiYuan workspace database. The data remains accessible across sessions and can be seen by all workspace users, including those with lower privileges. This risk is further compounded when coupled with another vulnerability, potentially allowing a non-admin user to access sensitive information, including secrets that have been imported. The issue has been addressed in version 3.6.1.

References