CVE-2026-32749

CRITICAL EPSS 34.8%
Published Mar 19, 20263mo ago · Modified Jun 17, 20262w ago
9.1 CVSS 3.1
Critical
Find Similar
Published Mar 19, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archives to a path derived from the multipart filename field without sanitization, allowing an admin to write files to arbitrary locations outside the temp directory - including system paths that enable RCE. This can lead to aata destruction by overwriting workspace or application files, and for Docker containers running as root (common default), this grants full container compromise. This issue has been fixed in version 3.6.1.

CVSS Details

Base Score
9.1
Exploitability
2.3
Impact
6.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
34.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-22 Path Traversal Resource Mgmt
CWE-73

Affected Products 1

VendorProductVersionRange
b3logsiyuan* <3.6.1

References 3

  • github.com https://github.com/siyuan-note/siyuan/commit/5ee00907f0b0c4aca748ce21ef1977bb98178e14
    Patch
  • github.com https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1
    Release Notes
  • github.com https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvvf-q994-x79v
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/siyuan-note/siyuan/commit/5ee00907f0b0c4aca748ce21ef1977bb98178e14
    Patch