CVE-2026-32750 Details

A vulnerability exists in SiYuan personal knowledge management system, specifically in versions through 3.6.0. The issue arises in the POST /api/import/importStdMd endpoint, where the localPath parameter is passed to the model.ImportFromLocalPath function without any path validation. This lack of validation allows the function to recursively read all files under the specified path and permanently save their contents as SiYuan note documents in the workspace database. These notes become searchable and accessible to all users in the workspace. The imported data remains in the database after restarts and can be accessed by Publish Service Reader accounts. This vulnerability can be exploited by an admin user to import sensitive files, which can then be accessed by a non-admin user through a chained SQL injection attack, according to the advisory.

Users can upgrade to SiYuan version 3.6.1, which addresses this vulnerability by implementing proper path validation in the import API.