CVE-2026-32749: Path Traversal in Siyuan Kernel

The vulnerability lies in the importSY and importZipMd functions within the kernel/api/import.go file. These functions construct file paths based on user-supplied filenames during import operations without proper sanitization. An attacker can craft malicious filenames containing path traversal sequences (e.g., ../../../../etc/passwd) to write files to arbitrary locations on the server's filesystem. This could allow them to overwrite critical system files, inject malicious code, or gain unauthorized access to sensitive data. The potential for RCE significantly elevates the risk, as a successful exploit could grant an attacker complete control over the affected system. This is similar to other path traversal vulnerabilities where attackers leverage file system navigation to bypass security controls.

1. Reserved2026-03-13
2. Published2026-03-16
3. Modified2026-03-30
4. EPSS updated2026-03-27

The primary mitigation is to upgrade to Siyuan kernel version 3.6.1 or later, which contains the necessary fix. If immediate upgrading is not possible, consider implementing temporary workarounds. One approach is to restrict file upload permissions for administrative users, limiting their ability to trigger the vulnerable import functionality. Additionally, implement a Web Application Firewall (WAF) rule to block requests containing suspicious path traversal sequences in the filename parameter. Monitor system logs for unusual file creation activity in unexpected directories. Specifically, look for files being created outside the designated temporary import directory. After upgrading, confirm the fix by attempting a file import with a malicious filename containing path traversal characters and verifying that the file is not written to the intended location.