CVE-2026-73605 describes a path traversal vulnerability in SiYuan note-taking software prior to version 3.7.4. The vulnerability exists in the getUniqueFilename endpoint, which fails to validate or confine user-supplied paths. As a result, unauthenticated attackers can probe arbitrary absolute filesystem paths to determine the existence of files and directories. This information disclosure can aid attackers in mapping the filesystem and identifying installed software components. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, low confidentiality impact, and no impact on integrity or availability.

The vulnerability allows unauthenticated attackers to perform filesystem reconnaissance by verifying the existence of arbitrary files and directories. This can reveal sensitive information about the host environment and installed software, potentially aiding further targeted attacks. However, it does not directly allow modification, deletion, or execution of files, limiting the impact to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the getUniqueFilename endpoint or deploy compensating controls such as web application firewalls to detect and block path traversal attempts. Monitor for unusual requests targeting this endpoint. Avoid exposing the service to untrusted networks if possible.