Medium severity5.8NVD Advisory· Published Aug 13, 2026· Updated Aug 26, 2026

CVE-2026-73605

Description

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on the host, enabling reconnaissance of the filesystem layout and installed software.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Siyuan Note/Siyuanllm-fuzzy
Range: <v3.7.4

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-hf8h-97gm-4x2pnvd
www.vulncheck.com/advisories/siyuan-before-path-traversal-via-getuniquefilenamenvd

News mentions

Siyuan Note: 25 Vulnerabilities Including RCE and Auth Bypass Disclosed Together
Vypr Intelligence · Aug 15, 2026

cvss	0.377
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000