CVE-2026-40318: b3log siyuan Path Traversal: '../filedir'

Vulnerability summary

CVE-2026-40318 is a high (CVSS 8.5) Path Traversal: '../filedir' vulnerability in b3log siyuan. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.

Timeline

1. 16-04-2026
   PublishedVulnerability first disclosed.
2. 18-04-2026
   Last modifiedVulnerability information updated.

Description

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

• CWE-24Path Traversal: '../filedir'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.