What’s Vulnerable › Vulnerabilities

CVE-2026-69086: SiYuan before v3.7.3 Path Traversal via unvalidated avID

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-03 · updated 2026-10-23
• Weakness: CWE-22

Description

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope database content.

Affected products

• siyuan-note siyuan: before 3.7.3 — fixed in 3.7.3

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.7.3. Check the vendor advisory for mitigations.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7hm9-v7vf-7g4w
• https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-unvalidated-avid

Get alerted when CVE-2026-69086 or the next vulnerability affects your stack