What is the CVSS score of EUVD-2026-42744?

EUVD-2026-42744 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Siyuan are affected by EUVD-2026-42744?

SiYuan personal knowledge management system versions prior to 3.7.1 contain an authenticated path traversal vulnerability allowing low-privileged users to read arbitrary workspace files, including…. A patch is available.

How to fix or mitigate EUVD-2026-42744?

Within 24 hours: Inventory all SiYuan installations and identify systems running versions prior to 3.7.1; implement network-level access restrictions as interim protection. Within 7 days: Upgrade all affected SiYuan instances to version 3.7.1 or later. Within 30 days: Audit system logs for exploitation attempts (malicious requests to /snippets endpoint with traversal sequences like %2e%2e); rotate workspace secrets if unauthorized access is detected.

Siyuan EUVD-2026-42744

| CVE-2026-59832 HIGH

Path Traversal (CWE-22)

2026-07-09 GitHub_M

GHSA-275h-v5h9-vr82

Path Traversal Siyuan Siyuan Note

7.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Sep 02, 2026 - 16:02 EUVD

Analysis Generated

Jul 09, 2026 - 23:28 vuln.today

DescriptionCVE.org

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticated request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to read workspace secrets and the document database. This issue is fixed in versions 3.7.1.

AnalysisAI

Authenticated path traversal in SiYuan personal knowledge management system (versions prior to 3.7.1) lets a low-privileged user read arbitrary workspace files by abusing the /snippets/*filepath handler. Because serveSnippets in kernel/server/serve.go single-decodes the request path and joins it to the snippets directory without containment or sensitive-file checks, a request like /snippets/%2e%2e/%2e%2e/conf/conf.json returns workspace secrets and the document database. No public exploit identified at time of analysis, though the fixing commit publicly reveals the vulnerable code path.