Vulnerability · Published Mar 19, 2026 · Assigned by GitHub_M

CVE-2026-32749SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

High 7.6

In plain English

A high-severity path traversal in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.5%top 60.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archives to a path derived from the multipart filename field without sanitization, allowing an admin to write files to arbitrary locations outside the temp directory - including system paths that enable RCE. This can lead to aata destruction by overwriting workspace or application files, and for Docker containers running as root (common default), this grants full container compromise. This issue has been fixed in version 3.6.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/siyuan-note/siyuan/kernel	no fix listed	GHSA-qvvf-q994-x79v
Go	github.com/siyuan-note/siyuan/kernel	no fix listed	GO-2026-4707

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	< 3.6.1

Weakness: CWE-73, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvvf-q994-x79v x_refsource_CONFIRM
https://github.com/siyuan-note/siyuan/commit/5ee00907f0b0c4aca748ce21ef1977bb98178e14 x_refsource_MISC
https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1 x_refsource_MISC