CVE-2026-33194

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the `IsSensitivePath()` function in `kernel/util/path.go` uses a denylist approach that was recently expanded (GHSA-h5vh-m7fg-w5h6, commit 9914fd1) but remains incomplete. Multiple security-relevant Linux directories are not blocked, including `/opt` (application data), `/usr` (local configs/binaries), `/home` (other users), `/mnt` and `/media` (mounted volumes). The `globalCopyFiles` and `importStdMd` endpoints rely on `IsSensitivePath` as their primary defense against reading files outside the workspace. Version 3.6.2 contains an updated fix.

• CWE-22

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vm69-h85x-8p85Exploit, Mitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33189Rejected reason: Further research determined the issue origi…
• CVE-2026-3319Reflected Cross-Site Scripting (XSS) in the latest demo vers…5.1
• CVE-2026-33190CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-33191Free5GC is an open-source Linux Foundation project for 5th g…8.6
• CVE-2026-33192Free5GC is an open-source Linux Foundation project for 5th g…5.3
• CVE-2026-33193Docmost is open-source collaborative wiki and documentation …4.6
• CVE-2026-33195Active Storage allows users to attach cloud and local files …9.8
• CVE-2026-3320Reflected Cross-Site Scripting (XSS) in the latest demo vers…5.1
• CVE-2026-33201Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., L…7
• CVE-2026-33202Active Storage allows users to attach cloud and local files …9.1
• CVE-2026-33203SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2026-33204SimpleJWT is a simple JSON web token library written in PHP.…7.5