Path Traversal in Siyuan-note Siyuan
CVE-2026-41894
SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did not address the root cause — a redundant url.PathUnescape() call in serveExport…
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.003 (23.4th percentile) — read the EPSS interpretation.
Affected products
- Siyuan-note Siyuan — versions < 3.6.5
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)