What is CVE-2026-69086?

CVE-2026-69086 is a high-severity vulnerability in Siyuan-Note Siyuan, classified under Path Traversal. CVSS score: 7.7/10. Published 2026-08-03.

How severe is CVE-2026-69086?

High severity. CVSS v3 base score is 7.7 out of 10.

Path Traversal in Siyuan-Note Siyuan

CVE-2026-69086

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope database content.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.004 (28.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

Affected products

Siyuan-note Siyuan — versions 0, 3.7.3

Weakness classification (CWE)

CWE-22 — Path Traversal

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-69086?: CVE-2026-69086 is a high-severity vulnerability in Siyuan-Note Siyuan, classified under Path Traversal. CVSS score: 7.7/10. Published 2026-08-03.
How severe is CVE-2026-69086?: High severity. CVSS v3 base score is 7.7 out of 10.