CVE-2026-32749 Details
Description
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploaded archives to a path derived from the multipart filename field without sanitization, allowing an admin to write files to arbitrary locations outside the temp directory - including system paths that enable RCE. This can lead to aata destruction by overwriting workspace or application files, and for Docker containers running as root (common default), this grants full container compromise. This issue has been fixed in version 3.6.1.
A vulnerability in SiYuan personal knowledge management system versions through 3.6.0 allows for arbitrary file writes and potential remote code execution. The issue arises in the import functions of the application's API, where uploaded archives are written to a path based on the multipart filename without proper sanitization. This flaw enables an admin to place files in arbitrary locations outside the temporary directory, including system paths that could lead to remote code execution. The vulnerability also poses a risk of data destruction by overwriting important workspace or application files. In Docker containers running as root, which is the default, this could result in full container compromise.
Users can upgrade to SiYuan version 3.6.1, which addresses this vulnerability by sanitizing the file paths before writing them to the file system.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| b3log siyuan | < 3.6.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | New CVE Received | [email protected] |