CVE-2026-40318

HIGH

8.5

Beschreibung

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

CVE Details

CVSS v3.1 Bewertung8.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht4/16/2026

Zuletzt geandert4/20/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

b3log:siyuan

Schwachen (CWE)

CWE-24

Referenzen

https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4(security-advisories@github.com)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vw86-c94w-v3x4(security-advisories@github.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.