{"cve":"CVE-2026-32938","nvd":{"published":"2026-03-20T04:16:48.950","modified":"2026-06-17T10:36:35.860","status":"Analyzed","description":"SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file:// links in pasted HTML into the workspace assets directory without validating paths against a sensitive-path list. Together with GET /assets/*path, which only requires authentication, a publish-service visitor can cause the desktop kernel to copy any readable sensitive file and then read it via GET, leading to exfiltration of sensitive files. This issue has been fixed in version 3.6.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-22","CWE-200","CWE-284"],"references":["https://github.com/siyuan-note/siyuan/commit/294b8b429dea152cd1df522cddf406054c1619ad","https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1","https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fq2j-j8hc-8vw8"],"products":["b3log:siyuan"],"source":"nvd","synced_at":"2026-10-19T22:26:19.218427112+00:00"},"epss":{"cve":"CVE-2026-32938","score":0.00421,"percentile":0.36455,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-fq2j-j8hc-8vw8","url":"https://osv.dev/vulnerability/GHSA-fq2j-j8hc-8vw8","summary":"SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service","modified":"2026-03-30T14:02:48Z","packages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel","ranges":["<=0.0.0-20260313024916-fd6526133bb3"],"fixed":[]}]},{"id":"GO-2026-4722","url":"https://osv.dev/vulnerability/GO-2026-4722","summary":"SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service in github.com/siyuan-note/siyuan/kernel","modified":"2026-03-26T21:03:11.127129Z","packages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}