CVE-2026-32749: SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write
(updated )
POST /api/import/importSY and POST /api/import/importZipMd write uploaded archives to a path derived from the multipart filename field without sanitization, allowing an admin to write files to arbitrary locations outside the temp directory - including system paths that enable RCE.
References
- github.com/advisories/GHSA-qvvf-q994-x79v
- github.com/siyuan-note/siyuan
- github.com/siyuan-note/siyuan/commit/5ee00907f0b0c4aca748ce21ef1977bb98178e14
- github.com/siyuan-note/siyuan/releases/tag/v3.6.1
- github.com/siyuan-note/siyuan/security/advisories/GHSA-qvvf-q994-x79v
- nvd.nist.gov/vuln/detail/CVE-2026-32749
Code Behaviors & Features
Detect and mitigate CVE-2026-32749 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →