VulnerabilityAnalyzed

CVE-2026-32938

SiYuan is a personal knowledge management system.

MEDIUM 6.5EPSS 0.41%

Does this matter?

Lower severity and a low EPSS score (0.41%). Track it; it rarely justifies an emergency change on its own.

Description

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file:// links in pasted HTML into the workspace assets directory without validating paths against a sensitive-path list. Together with GET /assets/*path, which only requires authentication, a publish-service visitor can cause the desktop kernel to copy any readable sensitive file and then read it via GET, leading to exfiltration of sensitive files. This issue has been fixed in version 3.6.1.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.41% probability · 35th percentile
CISA KEV: Not listed
Weakness: CWE-22, CWE-200, CWE-284
Affected: b3log/siyuan
Source: security-advisories@github.com

References

https://github.com/siyuan-note/siyuan/commit/294b8b429dea152cd1df522cddf406054c1619adPatch
https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1Release Notes
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fq2j-j8hc-8vw8Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.