CVE-2026-33670 in SiYuan
Summary
SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. Version 3.6.2 patches the issue.
Responsible
GitHub_M
Reservation
03/23/2026
Disclosure
03/27/2026
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 353744 | SiYuan readDir path traversal | 22 | Not defined | Official fix | CVE-2026-33670 |