HIGH🇵🇱 Wersja polska

CVE-2026-40318

CVSS 8.5v3.1pub. 2026-04-16upd. 2026-04-20

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

  • B3log Siyuan

    APP
    B3Log
    < 3.6.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2026-40322CRITICAL9.0PL ✓ten sam produkt

B3Log SiYuan: XSS w diagramach Mermaid eskaluje do RCE w Electron

CVE-2026-39846CRITICAL9.0PL ✓ten sam produkt

RCE przez stored XSS w kliencie desktopowym B3Log SiYuan

CVE-2026-34449CRITICAL9.6PL ✓ten sam produkt

RCE w SiYuan poprzez nadmiernie permisywną politykę CORS

CVE-2026-34448CRITICAL9.0PL ✓ten sam produkt

Stored XSS → RCE w B3Log SiYuan via złośliwy URL w Attribute View

CVE-2026-33670CRITICAL9.8PL ✓ten sam produkt

Path Traversal w B3Log SiYuan — nieautoryzowane odczytywanie struktury plików