CVE-2026-32749

SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

State: Published
Severity: 7.6 High
Published: Mar 19, 2026
Updated: Mar 20, 2026
Reserved: Mar 13, 2026

Description

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archives to a path derived from the multipart filename field without sanitization, allowing an admin to write files to arbitrary locations outside the temp directory - including system paths that enable RCE. This can lead to aata destruction by overwriting workspace or application files, and for Docker containers running as root (common default), this grants full container compromise. This issue has been fixed in version 3.6.1.

Scores

CVSS	Score	Vector	Source
3.1	7.6 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N	GitHub_M

Weaknesses

CWE-73 External Control of File Name or Path
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
siyuansiyuan-note	< 3.6.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.