Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-33669

SiYuan has Arbitrary Document Reading within the Publishing Service

Description

SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6.2 patches the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

siyuan-note siyuan

  • < 3.6.2affected

References