CVE-2026-40318

Katalog CVE

CVSS 8.5 · High EPSS 0,44%

Kerentanan Path Traversal: '../filedir' pada b3log siyuan. Skor CVSS 3.1 8.5 (High) menurut github.com.

Deskripsi (NVD)

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

Rincian

Terbit di NVD

16 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-24: Path Traversal: '../filedir'

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vw86-c94w-v3x4 advisory pihak ketiga
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 release notes