Path Traversal Vulnerability in SiYuan by SiYuan Note

CVE-2026-73605

What is CVE-2026-73605?

SiYuan versions prior to v3.7.4 are susceptible to a path traversal vulnerability within the getUniqueFilename endpoint. This issue permits unauthorized users to probe the filesystem, as it allows the submission of arbitrary absolute paths to check the existence of files and directories without proper validation. Such behavior can lead to reconnaissance activities, giving attackers insight into the filesystem structure and potentially the software installed on the host, raising serious security concerns.

References