CVE-2026-32938 - Vulnerability Analysis

Overview

SiYuan <= 3.6.0 contains an information disclosure caused by improper validation of file:// links in /api/lute/html2BlockDOM, letting authenticated publish-service visitors exfiltrate sensitive files via GET /assets/*path.

Severity & Score

Impact

Authenticated visitors can exfiltrate sensitive files from the system, leading to data leakage.

Mitigation

Update to version 3.6.1 or later.

References

• https://github.com/siyuan-note/siyuan/commit/294b8b429dea152cd1df522cddf406054c1619ad
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fq2j-j8hc-8vw8

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 20, 2026

🔴 CVE-2026-32938 - Critical (9.9) SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file:// links in pasted HTML into the workspace assets directory without validating paths ag... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32938/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner