CVE-2026-40318

The record

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

Affected packages

Related vulnerabilities

• GHSA-vw86-c94w-v3x4 SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView` Same vulnerability
• CVE-2026-14947 A high-privileged remote attacker can upload malicious ZIP archive containing directory… CWE-24
• CVE-2026-76353 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… CWE-24
• CVE-2026-73573 In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in… CWE-24
• CVE-2026-66140 Exim before 4.99.5 allows directory traversal to access files outside of the spool area… CWE-24
• CVE-2026-44942 A path traversal in handling the "path" component of .repo files processed by libzypp… CWE-24
• CVE-2026-49103 Webmin before 2.640 does not safely construct a filename for saving of an attachment… CWE-24
• CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from… CWE-24