CVE-2026-33669 CRITICAL

CVE-2026-33669: SiYuan has Arbitrary Document Reading within the Publishing Service

Vendor Siyuan-Note

Product siyuan

Weakness CWE-125

Published March 26, 2026

Last update March 27, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6.2 patches the issue.

Key dates

02Disclosure timeline

March 26, 2026 CVE published

March 27, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-33669 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/125.html

Related vulnerabilities

04Related CVE

CVE-2023-20094 Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure Vulnerability CVE-2022-38417 Adobe InDesign SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability CVE-2026-40890 github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer CVE-2021-28573 Adobe Animate out-of-bounds read vulnerability could lead to information exposure CVE-2026-40025 Sleuth Kit APFS Keybag Parser Out-of-Bounds Read