Vulnerability · Published Apr 16, 2026 · Assigned by GitHub_M

CVE-2026-40318SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`

High 8.5

In plain English

A high-severity security flaw in siyuan from siyuan-note. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.3%top 78.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/siyuan-note/siyuan/kernel	3.6.40.0.0-20260407035653-2f416e5253f1	GHSA-vw86-c94w-v3x4
Go	github.com/siyuan-note/siyuan/kernel	no fix listed	GO-2026-5679

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	< 3.6.4

Weakness: CWE-24 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vw86-c94w-v3x4 x_refsource_CONFIRM
https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 x_refsource_MISC