CVE-2026-32747 Details
Description
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the globalCopyFiles API eads source files using filepath.Abs() with no workspace boundary check, relying solely on util.IsSensitivePath() whose blocklist omits /proc/, /run/secrets/, and home directory dotfiles. An admin can copy /proc/1/environ or Docker secrets into the workspace and read them via the standard file API. An admin can exfiltrate any file readable by the SiYuan process that falls outside the incomplete blocklist. In containerized deployments this includes all injected secrets and environment variables - a common pattern for passing credentials to containers. The exfiltrated files are then accessible via the standard workspace file API and persist until manually deleted. This issue has been fixed in version 3.6.1.
A vulnerability exists in SiYuan personal knowledge management system, specifically in versions 3.6.0 and prior. The issue arises in the globalCopyFiles API, which reads source files without proper workspace boundary checks. It relies on a path sensitivity check that omits critical directories such as /proc/, /run/secrets/, and home directory dotfiles. This oversight allows an admin to copy sensitive files, like Docker secrets or environment variables, into the workspace, where they can be accessed through the standard file API. The vulnerability has been patched in version 3.6.1.
Users can update to SiYuan version 3.6.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h5vh-m7fg-w5h6 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/siyuan-note/siyuan/commit/9914fd1d39e5f0a8dcc9fb587e1c0b46f31490a1 | [email protected] | Patch |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1 | [email protected] | Release Notes |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h5vh-m7fg-w5h6 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| b3log siyuan | < 3.6.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | New CVE Received | [email protected] |