CVE-2026-33476 is a path traversal vulnerability (CWE-22) found in Siyuan Note, a personal knowledge management system. The issue exists in versions prior to 3.6.2 where the Siyuan kernel exposes an unauthenticated file-serving endpoint under the path /appearance/*filepath. This endpoint explicitly excludes authentication checks, allowing any remote attacker to access it without credentials. Due to improper sanitization of the filepath parameter, attackers can craft specially formed requests that traverse directories outside the intended restricted directory. This enables reading of arbitrary files accessible by the server process, potentially exposing sensitive configuration files, user data, or system files. The vulnerability does not require user interaction and can be exploited remotely over the network with low attack complexity. The CVSS v3.1 base score is 7.5, reflecting high confidentiality impact but no impact on integrity or availability. The flaw was addressed in Siyuan Note version 3.6.2 by properly sanitizing the filepath input and enforcing access controls on the endpoint.

This vulnerability allows unauthorized remote attackers to read arbitrary files on the server running vulnerable Siyuan Note instances. The confidentiality of sensitive information such as user notes, configuration files, credentials, or other private data stored on the server can be compromised. This could lead to further attacks such as credential theft, lateral movement, or exposure of intellectual property. Since the vulnerability requires no authentication and no user interaction, it significantly lowers the barrier for exploitation. Organizations relying on Siyuan Note for personal or enterprise knowledge management risk data breaches and loss of privacy. Although integrity and availability are not directly impacted, the exposure of sensitive files can have severe operational and reputational consequences.

1. Upgrade Siyuan Note to version 3.6.2 or later immediately to apply the official patch that fixes the path traversal vulnerability. 2. If upgrading is not immediately possible, restrict network access to the Siyuan Note server, limiting exposure to trusted internal networks only. 3. Implement web application firewalls (WAFs) with rules to detect and block path traversal attack patterns targeting the /appearance/ endpoint. 4. Conduct regular audits of server file permissions to ensure the Siyuan process runs with the least privileges necessary, minimizing accessible files. 5. Monitor server logs for suspicious requests containing directory traversal sequences such as ../ or encoded variants. 6. Educate administrators to disable or restrict unauthenticated endpoints where feasible. 7. Consider deploying runtime application self-protection (RASP) solutions to detect and block exploitation attempts in real time.