SiYuan up to 3.6.0 Docker Container /api/import/importSY filename file inclusion

Summaryinfo

A vulnerability described as problematic has been identified in SiYuan up to 3.6.0. The impacted element is an unknown function of the file /api/import/importSY of the component Docker Container Handler. The manipulation of the argument filename results in file inclusion. This vulnerability is known as CVE-2026-32749. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in SiYuan up to 3.6.0. Affected is an unknown code block of the file /api/import/importSY of the component Docker Container Handler. The manipulation of the argument filename with an unknown input leads to a file inclusion vulnerability. CWE is classifying the issue as CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archives to a path derived from the multipart filename field without sanitization, allowing an admin to write files to arbitrary locations outside the temp directory - including system paths that enable RCE. This can lead to aata destruction by overwriting workspace or application files, and for Docker containers running as root (common default), this grants full container compromise. This issue has been fixed in version 3.6.1.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-32749 since 03/13/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation requires an enhanced level of successful authentication. Technical details are known, but there is no available exploit.

Upgrading to version 3.6.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5ee00907f0b0c4aca748ce21ef1977bb98178e14 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• SiYuan

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion