CVE-2026-40318
High
Description
SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.
SeverityHigh
CVSS8.5
Exploit probability—
ProductB3log Siyuan
PublishedApr 16, 2026
First seenApr 16, 2026
Weakness typeCWE-24CWE-24
How to fix
Update
- b3log siyuan3.6.4 or later
- github.com/siyuan-note/siyuan/kernel3.6.40.0.0-20260407035653-2f416e5253f1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| b3log siyuan | v < 3.6.4 | 3.6.4 |
| github.com/siyuan-note/siyuan/kernelGo | v < 3.6.40.0.0-20260407035653-2f416e5253f1, No range specified | 3.6.40.0.0-20260407035653-2f416e5253f1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.