HIGH🇬🇧 English

CVE-2026-40318

CVSS 8.5v3.1pub. 2026-04-16upd. 2026-04-20

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

oryginał EN

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

B3log Siyuan
APP
B3Log
< 3.6.4

🔵

ZWERYFIKUJ U PRODUCENTA

Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.

Tagi

Path Traversal

CWE

Referencje

github.com/siyuan-note/siyuan/releases/tag/v3.6.4…

github.com/siyuan-note/siyuan/security/advisories/GHSA-…

Powiązane podatności

CVE-2026-40322CRITICAL9.0PL ✓ten sam produkt

B3Log SiYuan: XSS w diagramach Mermaid eskaluje do RCE w Electron

CVE-2026-39846CRITICAL9.0PL ✓ten sam produkt

RCE przez stored XSS w kliencie desktopowym B3Log SiYuan

CVE-2026-34449CRITICAL9.6PL ✓ten sam produkt

RCE w SiYuan poprzez nadmiernie permisywną politykę CORS

CVE-2026-34448CRITICAL9.0PL ✓ten sam produkt

Stored XSS → RCE w B3Log SiYuan via złośliwy URL w Attribute View

CVE-2026-33670CRITICAL9.8PL ✓ten sam produkt

Path Traversal w B3Log SiYuan — nieautoryzowane odczytywanie struktury plików