CVE-2026-32749CWE-22CWE-73

SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

High · published March 19, 2026

CVSS v3.1
7.6
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archives to a path derived from the multipart filename field without sanitization, allowing an admin to write files to arbitrary locations outside the temp directory - including system paths that enable RCE. This can lead to aata destruction by overwriting workspace or application files, and for Docker containers running as root (common default), this grants full container compromise. This issue has been fixed in version 3.6.1.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00593 · 47.7th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path
Published
2026-03-19T21:07Z
EPSS history
Timeline
  • 19 MAR 21:07Z
    SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write
    cvelistv5