{"id":"EUVD-2026-39122","enisaUuid":"3c212716-8f77-3cc8-b97a-9d79a5ac43a2","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 (\"Path Traversal via Double URL Encoding\") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, default port 6808), an unauthenticated remote attacker can read arbitrary files inside WorkspaceDir — including conf/conf.json (which contains the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log — by double-URL-encoding .. segments. This vulnerability is fixed in 3.7.0.","datePublished":"Jun 24, 2026, 9:13:25 PM","dateUpdated":"Jun 25, 2026, 12:33:20 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4m3-mgmm-c664\n","aliases":"CVE-2026-54066\nGHSA-p4m3-mgmm-c664\n","assigner":"GitHub_M","epss":2.18,"enisaIdProduct":[{"id":"e3bdcf50-2f78-3844-b740-fa03c9bfdacb","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"\u003c 3.7.0"}],"enisaIdVendor":[{"id":"b69a1b37-637c-3be3-bd4f-ea9b66f4e840","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"3ea14cf6-a065-35d9-a03d-1cc1d895a45a","vulnerability":{"id":"CVE-2026-54066","description":"SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 (\"Path Traversal via Double URL Encoding\") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, default port 6808), an unauthenticated remote attacker can read arbitrary files inside WorkspaceDir — including conf/conf.json (which contains the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log — by double-URL-encoding .. segments. This vulnerability is fixed in 3.7.0.","datePublished":"Jun 24, 2026, 9:13:25 PM","dateUpdated":"Jun 25, 2026, 12:33:20 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4m3-mgmm-c664\n","enisa_id":"EUVD-2026-39122\n","assigner":"GitHub_M","epss":2.18,"dataProcessed":"Oct 30, 2026, 7:16:41 AM","vulnerabilityProduct":[{"id":"747c2c6b-e9e8-3a6e-b82b-193d3ab2a6c7","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"\u003c 3.7.0"}],"vulnerabilityVendor":[{"id":"4e4ecaf4-3c6f-3cfb-b5f1-7b33293c1543","vendor":{"name":"siyuan-note"}}]}},{"id":"d54060db-d4ef-31ec-a89e-77e7ee8bd8bc","vulnerability":{"id":"GHSA-p4m3-mgmm-c664","description":"SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary   file─read), Incomplete fix of CVE-2026-41894 ","datePublished":"Jul 10, 2026, 7:25:04 PM","dateUpdated":"Jul 10, 2026, 7:25:04 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4m3-mgmm-c664\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54066\nhttps://github.com/siyuan-note/siyuan\n","enisa_id":"EUVD-2026-39122\n","aliases":"CVE-2026-54066\nGHSA-p4m3-mgmm-c664\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}