CVE-2026-33476 - Vulnerability Analysis

Overview

SiYuan < 3.6.2 contains a path traversal caused by improper path sanitization in the /appearance/*filepath endpoint, letting unauthenticated attackers read arbitrary files accessible to the server process, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can read arbitrary files accessible to the server, potentially exposing sensitive information.

Mitigation

Update to version 3.6.2 or later.

References

• https://github.com/siyuan-note/siyuan/commit/009bb598b3beccc972aa5f1ed88b3b224326bf2a
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 21, 2026

🟠 CVE-2026-33476 - High (7.5) SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversa... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33476/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner