SiYuan versions 3.6.0 and below contain a path traversal vulnerability that permits an authenticated administrator to perform arbitrary file writes, potentially leading to full system compromise.

The application fails to sanitize the filename parameter during file imports via the POST /api/import/importSY and POST /api/import/importZipMd endpoints. This allows an authenticated administrator to bypass directory restrictions and overwrite critical system or application files.

The ability to overwrite arbitrary files on the host system poses a severe risk to data integrity and system availability. With a CVSS score of 7.6, the vulnerability is particularly dangerous in containerized environments where the application runs as root, as it allows an attacker to escalate privileges to full container compromise. Successful exploitation could result in total loss of confidentiality and integrity within the affected instance.

Immediate Action: Upgrade to SiYuan version 3.6.1 or later immediately to incorporate the necessary path sanitization logic.

Proactive Monitoring: Review application logs for unusual file import activity or attempts to access directories outside of the designated import paths.

Compensating Controls: Implement strict file system permissions for the service account running the SiYuan process to limit the impact of unauthorized file writes. A Web Application Firewall may be configured to inspect and block requests containing directory traversal sequences in the multipart filename field.

Public Exploit Available: Unknown.

Given the potential for remote code execution and full container takeover, this vulnerability represents a high-risk security flaw. Administrators must prioritize the upgrade to version 3.6.1 to eliminate the underlying path traversal vector. Continued reliance on unpatched versions significantly increases the risk of unauthorized system modification and persistent compromise.