CVE-2026-40318
Received Received - Intake
Path Traversal in SiYuan API Allows Arbitrary File Deletion

Publication date: 2026-04-16

Last updated on: 2026-04-20

Assigner: GitHub, Inc.

Description
SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-16
Last Modified
2026-04-20
Generated
2026-06-16
AI Q&A
2026-04-17
EPSS Evaluated
2026-06-14
NVD
CVE-2026-40318
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
b3log siyuan to 3.6.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-24 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows an attacker to delete arbitrary .json files on the server, including global configuration files and workspace metadata, by exploiting a path traversal flaw. This could lead to loss of data integrity and availability.

However, there is no specific information provided about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, in versions 3.6.3 and earlier. The issue is in the /api/av/removeUnusedAttributeView endpoint, which uses a user-controlled 'id' parameter to build a filesystem path without validating or restricting it. Because of this, an attacker can include path traversal sequences like '../' in the 'id' parameter to escape the intended directory and delete arbitrary .json files on the server, including important files such as global configuration files and workspace metadata.

This vulnerability was fixed in version 3.6.4.

Impact Analysis

An attacker exploiting this vulnerability can delete arbitrary .json files on the server hosting SiYuan. This can lead to loss of important data such as global configuration files and workspace metadata, potentially disrupting the normal operation of the system.

The impact includes integrity loss (modification or deletion of data) and availability issues (system or data becoming unavailable), as indicated by the CVSS score which rates the impact on availability as high.

Mitigation Strategies

The vulnerability is fixed in SiYuan version 3.6.4. Immediate mitigation involves upgrading SiYuan to version 3.6.4 or later.

Until the upgrade can be performed, restrict access to the /api/av/removeUnusedAttributeView endpoint to trusted users only, as the vulnerability allows deletion of arbitrary .json files via path traversal.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40318. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart