CVE-2026-33669
Information Disclosure in SiYuan Prior to 3.6.2 via API Endpoints
Publication date: 2026-03-26
Last updated on: 2026-03-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| b3log | siyuan | to 3.6.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in SiYuan, a personal knowledge management system, exists in versions prior to 3.6.2. It involves the way document IDs were accessed through the /api/file/readDir interface, which then allowed the /api/block/getChildBlocks interface to view the content of all documents. This means an attacker could potentially retrieve and view all document contents by exploiting these interfaces.
How can this vulnerability impact me? :
This vulnerability can have a severe impact as it allows unauthorized access to all document contents within the SiYuan system. Given the CVSS score of 9.8, it indicates a critical risk with high confidentiality, integrity, and availability impacts, meaning sensitive information could be exposed, altered, or deleted without permission.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade SiYuan to version 3.6.2 or later, as this version patches the issue.