CVE-2026-33670CWE-22

SiYuan has directory traversal within its publishing service

Critical · published March 26, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. Version 3.6.2 patches the issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00624 · 49.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-26T21:15Z
EPSS history
Timeline
  • 26 MAR 21:15Z
    SiYuan has directory traversal within its publishing service
    cvelistv5