CVE-2026-40318

Received Received - Intake

Path Traversal in SiYuan API Allows Arbitrary File Deletion

Publication date: 2026-04-16

Last updated on: 2026-04-20

Assigner: GitHub, Inc.

Description

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-16

Last Modified

2026-04-20

Generated

2026-07-06

AI Q&A

2026-04-17

EPSS Evaluated

2026-07-05

NVD

CVE-2026-40318

Affected Vendors & Products

Vendor	Product	Version / Range
b3log	siyuan	to 3.6.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-24	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in SiYuan, an open-source personal knowledge management system, in versions 3.6.3 and earlier. The issue is in the /api/av/removeUnusedAttributeView endpoint, which uses a user-controlled 'id' parameter to build a filesystem path without validating or restricting it. Because of this, an attacker can include path traversal sequences like '../' in the 'id' parameter to escape the intended directory and delete arbitrary .json files on the server, including important files such as global configuration files and workspace metadata.

This vulnerability was fixed in version 3.6.4.

Impact Analysis

An attacker exploiting this vulnerability can delete arbitrary .json files on the server hosting SiYuan. This can lead to loss of important data such as global configuration files and workspace metadata, potentially disrupting the normal operation of the system.

The impact includes integrity loss (modification or deletion of data) and availability issues (system or data becoming unavailable), as indicated by the CVSS score which rates the impact on availability as high.

Mitigation Strategies

The vulnerability is fixed in SiYuan version 3.6.4. Immediate mitigation involves upgrading SiYuan to version 3.6.4 or later.

Until the upgrade can be performed, restrict access to the /api/av/removeUnusedAttributeView endpoint to trusted users only, as the vulnerability allows deletion of arbitrary .json files via path traversal.

Compliance Impact

The vulnerability allows an attacker to delete arbitrary .json files on the server, including global configuration files and workspace metadata, by exploiting a path traversal flaw. This could lead to loss of data integrity and availability.

However, there is no specific information provided about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-40318. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70