CVE-2026-33194
Received Received - Intake
Path Traversal in SiYuan Allows Unauthorized File Access

Publication date: 2026-03-20

Last updated on: 2026-03-23

Assigner: GitHub, Inc.

Description
SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist approach that was recently expanded (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) but remains incomplete. Multiple security-relevant Linux directories are not blocked, including `/opt` (application data), `/usr` (local configs/binaries), `/home` (other users), `/mnt` and `/media` (mounted volumes). The `globalCopyFiles` and `importStdMd` endpoints rely on `IsSensitivePath` as their primary defense against reading files outside the workspace. Version 3.6.2 contains an updated fix.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-03-23
Generated
2026-06-16
AI Q&A
2026-03-21
EPSS Evaluated
2026-06-14
NVD
CVE-2026-33194
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
b3log siyuan to 3.6.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in SiYuan, a personal knowledge management system, prior to version 3.6.2. The function IsSensitivePath() in the file kernel/util/path.go uses a denylist approach to block access to sensitive Linux directories. However, this denylist is incomplete and does not block several important directories such as /opt, /usr, /home, /mnt, and /media. Because the globalCopyFiles and importStdMd endpoints rely on IsSensitivePath() to prevent reading files outside the workspace, this incomplete denylist allows unauthorized access to files in these unblocked directories.

Impact Analysis

The vulnerability can allow an attacker with high privileges to read sensitive files outside the intended workspace by exploiting the incomplete denylist in the IsSensitivePath() function. This could lead to unauthorized disclosure of sensitive data stored in directories like /opt, /usr, /home, /mnt, and /media. The CVSS score of 6.8 indicates a medium to high severity impact, specifically a high confidentiality impact without affecting integrity or availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade SiYuan to version 3.6.2 or later, which contains the updated fix for the incomplete denylist in the IsSensitivePath() function.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33194. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart