Path Traversal Vulnerability in SiYuan by SiYuan Note

CVE-2026-69086

What is CVE-2026-69086?

Versions of SiYuan prior to v3.7.3 are vulnerable to a path traversal flaw due to inadequate validation of the avID parameter across all branches in the attribute-view read endpoints. This vulnerability allows both authenticated users with RoleReader permissions and anonymous users (if publish authentication is turned off) to craft traversal paths. Consequently, attackers can access JSON files outside the designated attribute-view directory, leading to the potential disclosure of sensitive database content across different scopes.

References