CVE-2026-33669CWE-125

SiYuan has Arbitrary Document Reading within the Publishing Service

Critical · published March 26, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6.2 patches the issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00516 · 43.1th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-03-26T21:14Z
EPSS history
Timeline
  • 26 MAR 21:14Z
    SiYuan has Arbitrary Document Reading within the Publishing Service
    cvelistv5