Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did not address the root cause — a redundant url.PathUnescape() call in serveExport(). An authenticated attacker can use double URL encoding (%252e%252e) to traverse directories and read arbitrary workspace files including the full SQLite database (siyuan.db), kernel log, and all user documents. This vulnerability is fixed in 3.6.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-24 | 1 | General1 |
| 2026-04-25 | 1 | Disclosure1 |
CVE-2026-41894 Directory Traversal in SiYuan Prior to 3.6.5 via Double URL Encoding https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41894
Post summary
The post discloses a directory traversal flaw (CVE-2026-41894) affecting SiYuan before version 3.6.5, identified as exploitible via double URL encoding, with technical details but without proof‑of‑concept, active exploitation, or patch information.
CVE-2026-41894 SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did not ad… https://www.cve.org/CVERecord?id=CVE-2026-41894
Post summary
The tweet only references CVE‑2026‑41894 and mentions a prior fix for a different CVE, providing no PoC, exploit detail, patch, or active usage evidence.