CVE-2026-33669
SiYuan has Arbitrary Document Reading within the Publishing Service
Summary
SiYuan has Arbitrary Document Reading within the Publishing Service
Original description
The description as published by the source.
SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6.2 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov