CVE-2026-32750

🗓️ 19 Mar 2026 21:15:32Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 12 Views🌐 WEB

SiYuan before 3.6.1 allows unvalidated localPath in importStdMd to create persistent notes and expose secrets.

Reporter	Title	Published	Views	Family All 23
Circl	CVE-2026-32750	14 Mar 202604:13	–	circl
CNNVD	SiYuan 安全漏洞	19 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-32750 SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes	19 Mar 202621:15	–	cvelist
Github Security Blog	SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes	16 Mar 202618:47	–	github
NVD	CVE-2026-32750	19 Mar 202622:16	–	nvd
OSV	CVE-2026-32750 SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes	19 Mar 202621:15	–	osv
OSV	GHSA-RJHH-M223-9QQV SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes	16 Mar 202618:47	–	osv
OSV	GO-2026-4708 SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes in github.com/siyuan-note/siyuan	26 Mar 202620:32	–	osv
OSV	SUSE-SU-2026:1135-1 Security update for govulncheck-vulndb	27 Mar 202617:33	–	osv
Positive Technologies	PT-2026-25825	16 Mar 202600:00	–	ptsecurity

NVD

Vulners

Node

b3log siyuanRange<3.6.1

[
  {
    "vendor": "siyuan-note",
    "product": "siyuan",
    "versions": [
      {
        "version": "< 3.6.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/siyuan-note/siyuan/releases/tag/v3.6.1
github	www.github.com/siyuan-note/siyuan/commit/13b6d3d45e83525654d120f32a3fdc5d9e95df0b
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-rjhh-m223-9qqv

Parameter	Position	Path	Description	CWE
localPath	request body	/api/import/importStdMd	In versions 3.6.0 and below, POST /api/import/importStdMd passes the localPath parameter directly to model.ImportFromLocalPath with zero path validation, causing recursive file reading and storage of contents as notes in the workspace database; combined with renderSprig SQL injection, a non-admin user can read all imported secrets.	CWE-22, CWE-552

17 Jun 2026 10:36Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.8

EPSS0.00431

SSVC