CVE-2026-33194

Received Received - Intake

Path Traversal in SiYuan Allows Unauthorized File Access

Publication date: 2026-03-20

Last updated on: 2026-03-23

Assigner: GitHub, Inc.

Description

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist approach that was recently expanded (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) but remains incomplete. Multiple security-relevant Linux directories are not blocked, including `/opt` (application data), `/usr` (local configs/binaries), `/home` (other users), `/mnt` and `/media` (mounted volumes). The `globalCopyFiles` and `importStdMd` endpoints rely on `IsSensitivePath` as their primary defense against reading files outside the workspace. Version 3.6.2 contains an updated fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-20

Last Modified

2026-03-23

Generated

2026-07-06

AI Q&A

2026-03-21

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33194

Affected Vendors & Products

Vendor	Product	Version / Range
b3log	siyuan	to 3.6.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in SiYuan, a personal knowledge management system, prior to version 3.6.2. The function IsSensitivePath() in the file kernel/util/path.go uses a denylist approach to block access to sensitive Linux directories. However, this denylist is incomplete and does not block several important directories such as /opt, /usr, /home, /mnt, and /media. Because the globalCopyFiles and importStdMd endpoints rely on IsSensitivePath() to prevent reading files outside the workspace, this incomplete denylist allows unauthorized access to files in these unblocked directories.

Impact Analysis

The vulnerability can allow an attacker with high privileges to read sensitive files outside the intended workspace by exploiting the incomplete denylist in the IsSensitivePath() function. This could lead to unauthorized disclosure of sensitive data stored in directories like /opt, /usr, /home, /mnt, and /media. The CVSS score of 6.8 indicates a medium to high severity impact, specifically a high confidentiality impact without affecting integrity or availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade SiYuan to version 3.6.2 or later, which contains the updated fix for the incomplete denylist in the IsSensitivePath() function.

Hi! I’m here to help you understand CVE-2026-33194. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70