CVE-2026-40318

Published: Apr 17, 2026 Last Modified: Apr 17, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: changed
Confidentiality: none
Integrity: low
Availability: high

Description

AI Translation Available

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

24

Path Traversal: '../filedir'

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Files Or Directories Modify Files Or Directories
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4
https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4
https://github.com/siyuan-note/siyuan/security/advisories/G…
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vw86-c94w-v3x4