CVE-2026-54066

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0

Description An unauthenticated remote attacker can read arbitrary files within the WorkspaceDir when the system is in publish mode, which is an anonymous read-only HTTP endpoint. This is achieved by using double-URL-encoding on .. segments in the /assets/*path endpoint. Sensitive files that may be accessed include conf/conf.json (containing the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log.

Recommendations Update SiYuan to version 3.7.0.