CVE-2026-33669 — SiYuan has Arbitrary Document Reading within the Publishing Service
SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks…
Published: 2026-03-26 · CVSS: 9.8 · CVSS 3.1
SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6.2 patches the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7