CVE-2026-40318
Path Traversal in SiYuan API Allows Arbitrary File Deletion
Publication date: 2026-04-16
Last updated on: 2026-04-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| b3log | siyuan | to 3.6.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-24 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to delete arbitrary .json files on the server, including global configuration files and workspace metadata, by exploiting a path traversal flaw. This could lead to loss of data integrity and availability.
However, there is no specific information provided about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability exists in SiYuan, an open-source personal knowledge management system, in versions 3.6.3 and earlier. The issue is in the /api/av/removeUnusedAttributeView endpoint, which uses a user-controlled 'id' parameter to build a filesystem path without validating or restricting it. Because of this, an attacker can include path traversal sequences like '../' in the 'id' parameter to escape the intended directory and delete arbitrary .json files on the server, including important files such as global configuration files and workspace metadata.
This vulnerability was fixed in version 3.6.4.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can delete arbitrary .json files on the server hosting SiYuan. This can lead to loss of important data such as global configuration files and workspace metadata, potentially disrupting the normal operation of the system.
The impact includes integrity loss (modification or deletion of data) and availability issues (system or data becoming unavailable), as indicated by the CVSS score which rates the impact on availability as high.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in SiYuan version 3.6.4. Immediate mitigation involves upgrading SiYuan to version 3.6.4 or later.
Until the upgrade can be performed, restrict access to the /api/av/removeUnusedAttributeView endpoint to trusted users only, as the vulnerability allows deletion of arbitrary .json files via path traversal.