CVE-2026-40318 SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`
Attackers can delete arbitrary JSON files on the server via path traversal in the removeUnusedAttributeView API endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40318?
CVE-2026-40318 is a high-severity path traversal vulnerability in B3log Siyuan, published on 16 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.
Weakness: CWE-24
Which versions are affected by CVE-2026-40318?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | None |
github.com/siyuan-note/siyuan/kernel Go | All versions | 3.6.40.0.0-20260407035653-2f416e5253f1 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 3.6.40.0.0-20260407035653-2f416e5253f1 |
Products include B3log Siyuan.
How do I fix CVE-2026-40318?
Upgrade github.com/siyuan-note/siyuan/kernel to 3.6.40.0.0-20260407035653-2f416e5253f1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40318 being exploited?
There is no known exploitation of CVE-2026-40318 in the wild and no public exploit code.
Other vulnerabilities in B3log Siyuan
- CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service
- CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service
- CVE-2026-33670 SiYuan has directory traversal within its publishing service
- CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
- CVE-2024-53504 SQL injection in n/a
Sources
Also known as GHSA-vw86-c94w-v3x4, GO-2026-5679.