Vulnerability · Published Aug 3, 2026 · Assigned by VulnCheck

CVE-2026-69086SiYuan before v3.7.3 Path Traversal via unvalidated avID

High 7.7

In plain English

A high-severity path traversal in siyuan from siyuan-note. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.5%top 54.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope database content.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/siyuan-note/siyuan/kernel	0.0.0-20260720151813-0f5a0e7c67b0	GHSA-7hm9-v7vf-7g4w
Go	github.com/siyuan-note/siyuan/kernel	0.0.0-20260720151813-0f5a0e7c67b0	GO-2026-6373

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.7.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-7hm9-v7vf-7g4w) vendor-advisory
VulnCheck Advisory: SiYuan before v3.7.3 Path Traversal via unvalidated avID third-party-advisory