CVE-2026-32938 Details

A vulnerability in SiYuan personal knowledge management system allows for arbitrary file reading. In versions through 3.6.0, the desktop application copies local files referenced by file:// links in pasted HTML into the workspace assets directory. This transfer occurs without validating the file paths against a list of sensitive directories. Once the files are in the assets directory, they can be accessed through a GET request, exfiltrating sensitive information. The vulnerability arises because the application fails to check for sensitive paths before copying files, enabling the retrieval of any readable file, such as those in the /etc or Windows System32 directories.

Users can update to SiYuan version 3.6.1, which addresses this vulnerability by implementing proper path validation before copying files into the assets directory.