CVE-2026-33476

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under /appearance/filepath. Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server...

CVE-2026-33476

creationtimestamp| type| source ---|---|--- 2026-03-20 13:54:07+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7 2026-03-20 23:18:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjnnk52zv2d 2026-03-20...