Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-21 | 1 | General1 |
| 2026-06-11 | 1 | Disclosure1 |
🚨 CVE-2026-33476 - high 🚨 SiYuan <= v3.6.1 - Path Traversal > SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan ... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-33476 @pdnuclei #NucleiTemplates #cve
Post summary
CVE-2026-33476 is highlighted as a high‑severity path traversal vulnerability affecting SiYuan versions up to 3.6.1, with no PoC, exploit code, or patch details provided.
CVE-2026-33476 SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filep… https://www.cve.org/CVERecord?id=CVE-2026-33476
Post summary
The text reports CVE‑2026‑33476, describing an unauthenticated file‑serving endpoint in SiYuan before version 3.6.2, without providing PoC, exploit, or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | b3log | siyuan | - | - | - |