CVE-2026-33476

Description

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.

PUBLISHED Reserved 2026-03-20 | Published 2026-03-20 | Updated 2026-03-23 | Assigner GitHub_M

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-73: External Control of File Name or Path

Product status

References

github.com/...siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7 exploit

github.com/...siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7

github.com/...ommit/009bb598b3beccc972aa5f1ed88b3b224326bf2a

cve.org (CVE-2026-33476)

nvd.nist.gov (CVE-2026-33476)

Download JSON