Directory Traversal Vulnerability in SiYuan Personal Knowledge Management System
CVE-2026-41894

7.1HIGH

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
24 April 2026

What is CVE-2026-41894?

SiYuan, an open-source personal knowledge management system, contains a directory traversal vulnerability due to a redundant url.PathUnescape() call in serveExport(). This issue allows authenticated attackers to exploit double URL encoding (%252e%252e) to traverse directories. Consequently, they can access arbitrary workspace files, including sensitive information such as the SQLite database (siyuan.db), kernel logs, and user documents. The vulnerability has been addressed in version 3.6.5.

Affected Version(s)

siyuan < 3.6.5

References

https://github.com/siyuan-note/siyuan/security/advisories...
x_refsource_CONFIRM
https://github.com/siyuan-note/siyuan/commit/bb481e1290c4...
x_refsource_MISC
https://github.com/siyuan-note/siyuan/releases/tag/v3.6.5
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.