CVE-2026-33670

7.5 highEPSS 0.7%

High (7.5) in b3log siyuan. EPSS 0.7% chance of exploitation in the next 30 days.

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. Version 3.6.2 patches the issue.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-03-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

b3log:siyuan

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-xmw9-6r43-x9ww	Go	github.com/siyuan-note/siyuan/kernel	<=0.0.0-20260317012524-fe4523fff2c8	no fix published
GO-2026-4843	Go	github.com/siyuan-note/siyuan/kernel	all versions	no fix published

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xmw9-6r43-x9ww

Check your stack JSON