CVE-2026-69086
SiYuan before v3.7.3 Path Traversal via unvalidated avID
- State
- Published
- Severity
- 8.3 High
- Published
- Aug 3, 2026
- Updated
- Aug 14, 2026
- Reserved
- Aug 3, 2026
Description
SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope database content.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.3 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | VulnCheck |
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
siyuansiyuan-note |
|
References
- GitHub Security Advisory (GHSA-7hm9-v7vf-7g4w)vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.3 Path Traversal via unvalidated avIDthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.