Which versions of SiYuan are affected by CVE-2026-69086?

SiYuan versions before 3.7.3 contain a path traversal vulnerability in attribute-view read endpoints that exposes sensitive database JSON files to unauthorized access.. A patch is available.

How to fix or mitigate CVE-2026-69086?

Within 24 hours, identify all SiYuan instances in your environment and document current versions; determine if publish authentication is enabled (disabled equals elevated risk); and initiate emergency change control processes. Within 7 days, deploy vendor patch v3.7.3 or later to all affected instances, prioritizing systems processing sensitive data or exposed to external networks. Within 30 days, complete post-patch verification testing, review server filesystem and access logs for evidence of file exfiltration during the vulnerability exposure window, and implement compensating network controls to restrict attribute-view endpoint access if any systems remain unpatched.

SiYuan CVE-2026-69086

Q: What is the CVSS score of CVE-2026-69086?

CVE-2026-69086 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52279 HIGH

Path Traversal (CWE-22)

2026-08-03 VulnCheck

GHSA-7hm9-v7vf-7g4w

GHSA-x7jr-gvvr-p9w7

Path Traversal Siyuan Siyuan Note

8.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

PR:L reflects mandatory RoleReader credential in default config; S:C because traversal escapes the attribute-view boundary into other scopes; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 14:26 vuln.today

Patch available

Aug 03, 2026 - 14:02 EUVD

CVE Published

Aug 03, 2026 - 13:20 cve.org

HIGH 8.3

DescriptionCVE.org

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope database content.

AnalysisAI

Path traversal in SiYuan's attribute-view read endpoints allows low-privileged users to read arbitrary JSON files outside the intended storage directory on versions before v3.7.3. The avID parameter is unsanitized across all code branches, enabling RoleReader-level authenticated users - or anonymous clients when publish authentication is disabled - to exfiltrate cross-scope database content stored as JSON on the server filesystem. No public exploit has been identified at time of analysis, and a vendor patch is available in v3.7.3.

Technical ContextAI

SiYuan is a self-hosted personal knowledge management system that uses attribute views (database/table views) to organize structured data. The vulnerable endpoints handle read requests for these attribute views and use the attacker-controlled avID parameter to construct file paths pointing to JSON storage files. Because no path validation or canonicalization is applied on any code branch, CWE-22 (Path Traversal) applies: an attacker can inject directory traversal sequences (e.g., ../../) into avID, causing the server to resolve paths outside the designated attribute-view storage directory. The CPE cpe:2.3:a:siyuan-note:siyuan:*:*:*:*:*:*:*:* confirms all versions from 0 through pre-3.7.3 are affected. The CVSS 4.0 SC:H metric indicates that files accessible through traversal span beyond the vulnerable component's own data scope - specifically, cross-scope database JSON content belonging to other workspaces or users.

RemediationAI

Upgrade SiYuan to v3.7.3 or later, which introduces proper avID parameter validation across all attribute-view read endpoint code branches, as confirmed by the vendor advisory at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7hm9-v7vf-7g4w. If immediate patching is not feasible, disable the publish/sharing feature or enforce publish authentication - this eliminates the anonymous exploitation path but will prevent legitimate unauthenticated access to published workspaces. Restrict RoleReader account provisioning to explicitly trusted users only, as low-privilege authenticated accounts remain exploitable on unpatched instances regardless of publish settings. As a network-level compensating control, place SiYuan behind a reverse proxy with IP allowlisting or VPN to eliminate external exposure - note this does not address insider or compromised-account threats.