Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-32749: SiYuan allows admin to write files anywhere via import

CVE-2026-32749 · published 7 months ago

Summary

Versions of SiYuan up to 3.6.0 let an administrator upload a file that can be placed in any location on the server, not just a temporary folder. This could let an attacker overwrite important files or take control of the system, especially in Docker setups that run as root. Upgrade to version 3.6.1 or later to stop the unsafe file placement.

What to do

Update b3log siyuan to version 3.6.1 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	b3log	siyuan	< 3.6.1 `cpe:2.3:a:b3log:siyuan::::::::`
go	github.com	siyuan-note	<= 0.0.0-20260313024916-fd6526133bb3
Go	siyuan-note	github.com/siyuan-note/siyuan/kernel	<= 0.0.0-20260313024916-fd6526133bb3

Original advisory text

SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archives to a path derived from the multipart filename field without sanitization, allowing an admin to write files to arbitrary locations outside the temp directory - including system paths that enable RCE. This can lead to aata destruction by overwriting workspace or application files, and for Docker containers running as root (common default), this grants full container compromise. This issue has been fixed in version 3.6.1.

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvvf-q994-x79v Vendor Advisory
https://github.com/advisories/GHSA-qvvf-q994-x79v
https://github.com/siyuan-note/siyuan/commit/5ee00907f0b0c4aca748ce21ef1977bb981... Patch
https://nvd.nist.gov/vuln/detail/CVE-2026-32749 Vendor Advisory
https://github.com/siyuan-note/siyuan Product
https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32749... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

CWE-73External Control of File Name or Path

Timeline

Published19 Mar 2026

Updated4 Nov 2026

First seen16 Mar 2026

Sources

GHSA-qvvf-q994-x79v · GHSA

CVE-2026-32749 · NVD

GO-2026-4707 · OSV

CVE-2026-32749 · OSV

Track software like this

Free during beta