CVE-2026-32750

MEDIUM EPSS 34.5%
Published Mar 19, 20263mo ago · Modified Jun 17, 20262w ago
6.8 CVSS 3.1
Medium
Find Similar
Published Mar 19, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importStdMd passes the localPath parameter directly to model.ImportFromLocalPath with zero path validation. The function recursively reads every file under the given path and permanently stores their content as SiYuan note documents in the workspace database, making them searchable and accessible to all workspace users. Data persists in the workspace database across restarts and is accessible to Publish Service Reader accounts. Combined with the renderSprig SQL injection ( separate advisory ), a non-admin user can then read all imported secrets without any additional privileges. This issue has been fixed in version 3.6.1.

CVSS Details

Base Score
6.8
Exploitability
2.3
Impact
4.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
34.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-22 Path Traversal Resource Mgmt
CWE-552

Affected Products 1

VendorProductVersionRange
b3logsiyuan* <3.6.1

References 3

  • github.com https://github.com/siyuan-note/siyuan/commit/13b6d3d45e83525654d120f32a3fdc5d9e95df0b
    Patch
  • github.com https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1
    Release Notes
  • github.com https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rjhh-m223-9qqv
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/siyuan-note/siyuan/commit/13b6d3d45e83525654d120f32a3fdc5d9e95df0b
    Patch