CVE-2026-33476 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/…
High CVSS: 7.5

CVE-2026-33476

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.
Vendor
B3log
Product
Siyuan
CWE
CWE-22
Yayın Tarihi
2026-03-20 23:16:48
Güncelleme
2026-03-23 22:16:31
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-22 Siyuan HIGH B3log 2026

Referanslar

https://github.com/siyuan-note/siyuan/commit/009bb598b3beccc972aa5f1ed88b3b224326bf2a https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7