← Back

CVE-2026-40318

nvd nist
Published: Apr 16, 2026Modified: Jun 17, 2026

JSON object

Loading...
8.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Exploitability: 3.1 / Impact: 4.7
Source: security-advisories@github.com (Secondary)

Description

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

Affected (1)

Products: B3log: Siyuan
B3log
1 product
Siyuan
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Siyuan
Before 3.6.4

Related CWEs

CWE-24
Path Traversal: '../filedir'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

References (2)

Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Third Party Advisory

Timeline

No history available yet.