CVE-2026-40318

Description

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.

Is your site exposed to CVE-2026-40318?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

EPSS — Exploit Prediction

0.0007

Probability of exploitation

0.20%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-24 CWE-24

Affected Products

Vendor	Product	Versions
b3log	siyuan	< 3.6.4

References

Other References

https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vw86-c94w-v3x4

Frequently Asked Questions

What is CVE-2026-40318? +

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4. It has a CVSS v3.1 base score of 8.5 (HIGH).

How severe is CVE-2026-40318? +

CVE-2026-40318 has a CVSS v3.1 score of 8.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0007, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-40318? +

CVE-2026-40318 affects products from b3log, specifically: siyuan. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-40318? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-59342

esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the …

CVE-2026-49103

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs …

CVE-2025-61318 9.1

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. …

CVE-2023-6699 9.1

The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, …

CVE-2025-54769 8.8

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in …

CVE-2025-53513 8.8

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller …