CVE-2026-32938
published 2026-03-20CVE-2026-32938: SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.41%
33.1th percentile
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file:// links in pasted HTML into the workspace assets directory without validating paths against a sensitive-path list. Together with GET /assets/*path, which only requires authentication, a publish-service visitor can cause the desktop kernel to copy any readable sensitive file and then read it via GET, leading to exfiltration of sensitive files. This issue has been fixed in version 3.6.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| b3log | siyuan | < 3.6.1 | 3.6.1 |
| github.com | siyuan-note_siyuan_kernel | 0 – 0.0.0-20260313024916-fd6526133bb3 | — |
| siyuan-note | siyuan | < 3.6.1 | 3.6.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service in github.com/siyuan-note/siyuan/kernel
osv·2026-03-26
CVE-2026-32938 SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service in github.com/siyuan-note/siyuan/kernel
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service in github.com/siyuan-note/siyuan/kernel
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service in github.com/siyuan-note/siyuan/kernel
OSV
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service
osv·2026-03-17
CVE-2026-32938 [CRITICAL] SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service
### Summary
In SiYuan, `/api/lute/html2BlockDOM` on the desktop copies local files pointed to by `file://` links in pasted HTML into the workspace assets directory without validating paths against a sensitive-path list. Together with `GET /assets/*path`, which only requires authentication, a publish-service visitor can cause the desktop kernel to copy any readable sensitive file and then read it via GET, leading to exfiltration of sensitive files.
### Details
#### 1. Arbitrary local files copied into workspace
- **Endpoint**: `POST /api/lute/html2BlockDOM`, protected only by `model.CheckAuth`; publish read-only role is not restricted.
- **Behavior**: On desktop (`util.ContainerStd == model.Conf.System.Container`), loc
GHSA
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service
ghsa·2026-03-17
CVE-2026-32938 [CRITICAL] CWE-200 SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service
### Summary
In SiYuan, `/api/lute/html2BlockDOM` on the desktop copies local files pointed to by `file://` links in pasted HTML into the workspace assets directory without validating paths against a sensitive-path list. Together with `GET /assets/*path`, which only requires authentication, a publish-service visitor can cause the desktop kernel to copy any readable sensitive file and then read it via GET, leading to exfiltration of sensitive files.
### Details
#### 1. Arbitrary local files copied into workspace
- **Endpoint**: `POST /api/lute/html2BlockDOM`, protected only by `model.CheckAuth`; publish read-only role is not restricted.
- **Behavior**: On desktop (`util.ContainerStd == model.Conf.System.Container`), loc
No detection rules found.
No public exploits indexed.
2026-03-20
Published