CVE-2026-69086 is a path traversal vulnerability affecting SiYuan note software versions before 3.7.3. The vulnerability is due to insufficient validation of the avID parameter in attribute-view read endpoints, which allows attackers to construct traversal paths that escape the storage directory. This enables authenticated users with RoleReader permissions or anonymous clients (when publish authentication is disabled) to read JSON files outside the attribute-view directory, potentially disclosing sensitive cross-scope database content. The vulnerability has a CVSS 4.0 base score of 8.3, indicating high severity. There is no vendor advisory or patch information available at this time, and the product is not a cloud service.

Exploitation of this vulnerability allows unauthorized reading of JSON files outside the intended storage directory, leading to disclosure of sensitive database content across different scopes. This can compromise confidentiality of stored data accessible via the attribute-view endpoints. The vulnerability affects users with limited permissions (RoleReader) and potentially anonymous users if publish authentication is disabled, broadening the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the attribute-view endpoints by ensuring publish authentication is enabled and limiting RoleReader permissions. Monitor for updates from the vendor regarding patches or official mitigations.