VYPR
← All advisories
Medium severity5.8NVD Advisory· Published Aug 13, 2026· Updated Oct 23, 2026

CVE-2026-73605

CVE-2026-73605

Description

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on the host, enabling reconnaissance of the filesystem layout and installed software.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/siyuan-note/siyuan/kernelGo
< 0.0.0-20260812083335-251596fc0de20.0.0-20260812083335-251596fc0de2

Affected products

2

Patches

Vulnerability mechanics

References

4

News mentions

1