Path Traversal Vulnerability in SiYuan by SiYuan Note

CVE-2026-82233

What is CVE-2026-82233?

SiYuan before version 3.8.1 is exposed to a path traversal vulnerability via the asset.upload tool. This flaw permits attackers to exploit the system by supplying arbitrary absolute file paths without necessary validations against workspace boundaries. By employing prompt injection techniques, malicious actors can manipulate the AI Agent to upload sensitive files, such as SSH keys and credentials, from outside the designated workspace into the asset directory, posing significant security risks.

References