High severity · published Aug 3, 2026
CVE-2026-69086
SiYuan before v3.7.3 Path Traversal via unvalidated avID
7.7
CVSS
0.5%
EPSS
No
On KEV
Description
SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope database content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.7.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-69086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-69086
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7hm9-v7vf-7g4w
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-unvalidated-avid
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP