CVE-2026-41894: Siyuan-Note Siyuan

High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days.

SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, the fix for CVE-2026-30869 only added a denylist check (IsSensitivePath) but did not address the root cause — a redundant url.PathUnescape() call in serveExport(). An authenticated attacker can use double URL encoding (%252e%252e) to traverse directories and read arbitrary workspace files including the full SQLite database (siyuan.db), kernel log, and all user documents. This vulnerability is fixed in 3.6.5.

Affected products

• Siyuan-Note Siyuan: before 3.6.5 (fixed in 3.6.5)

Published 2026-04-24. Last modified 2026-06-17.