VDB
CVE-2026-41894
CVE-2026-41894
PUBLISHED
CVSS 7.099999904632568 HIGH
SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did not address the root cause — a redundant url.PathUnescape() call in serveExport(). An authenticated attacker can use double URL encoding (%252e%252e) to traverse directories and read arbitrary workspace files including the full SQLite database (siyuan.db), kernel log, and all user documents. This vulnerability is fixed in 3.6.5.
EPSS 0.05% · 16.7th percentile
Risk Scores
CVSS v4.0
7.099999904632568
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.05%
16.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | < 3.6.5 |
Timeline
- Apr 22, 2026 CVE Published
- Apr 24, 2026 CVE Updated
- Apr 25, 2026 Security Advisory
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score