PT-2026-67408

CVE-2026-69086

Published

2026-08-03

Updated

2026-09-21

Description by

CVSS 4.0

8.3

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3

Description Insufficient validation of the avID parameter in attribute-view read endpoints allows attackers to create traversal paths that escape the storage directory. This enables authenticated users with RoleReader permissions, or anonymous clients if publish authentication is disabled, to read JSON files outside the attribute-view directory and disclose cross-scope database content.

Recommendations Update to version 3.7.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Shirshakhtml

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers