CVE-2026-32749: 
NixOS vulnerability analysis and mitigation

CVE-2026-32749 is a path traversal vulnerability in SiYuan, a personal knowledge management system, affecting versions 3.6.0 and below. The flaw exists in the POST /api/import/importSY and POST /api/import/importZipMd API endpoints, which write uploaded archives to a path derived from the multipart filename field without sanitization, enabling an authenticated admin to write files to arbitrary locations outside the intended temp directory. Disclosed on March 14, 2026, and patched in version 3.6.1, the vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) per Feedly threat intelligence data, though the GitHub Advisory Database scores it at 7.6 (High) (GitHub Advisory, SiYuan Advisory).

The root cause is classified as CWE-22 (Path Traversal) and CWE-73 (External Control of File Name or Path). In kernel/api/import.go, the vulnerable code constructs the write path as filepath.Join(util.TempDir, "import", file.Filename) without validating that the resolved path remains within the intended temp directory — while filepath.Join calls filepath.Clean internally, sufficient ../ sequences in the filename still escape the base directory entirely. The importZipMd function has a second traversal point in the unzipPath construction using the filename stem. Exploitation requires sending raw HTTP requests (e.g., via Python's requests library) because tools like curl sanitize ../ sequences in multipart filenames. The fix in commit 5ee0090 adds a util.IsSubPath() check to reject any resolved write path that falls outside the import directory (SiYuan Advisory, Patch Commit).

A successful exploit allows an authenticated admin to write arbitrary content to any path writable by the SiYuan process, enabling remote code execution (e.g., via /etc/cron.d/ injection on root containers), modification of ~/.bashrc or SSH authorized_keys, and destruction of workspace or application files. For Docker containers running as root — the common default deployment — this grants full container compromise, including potential lateral movement to the host if container isolation is insufficient. Confidentiality, integrity, and availability are all severely impacted in such environments (SiYuan Advisory, GitHub Advisory).

A complete, runnable proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of Python scripts using the requests library that directly exploit the path traversal to write arbitrary files and achieve RCE via cron injection on a live SiYuan instance (SiYuan Advisory). Exploitation requires admin-level authentication (high privileges), but no user interaction is needed. The EPSS score is approximately 0.043% (0.000430), indicating a currently low probability of active exploitation in the wild. No threat actor attribution or CISA KEV catalog listing has been identified at this time (GitHub Advisory).

1. Obtain admin credentials: Acquire a valid SiYuan admin token (e.g., via the accessAuthCode set at container startup or through credential theft).
2. Identify a vulnerable instance: Locate a SiYuan instance running version 3.6.0 or earlier, ideally deployed as a Docker container running as root (default), accessible on port 6806.
3. Craft a malicious multipart request: Using Python's requests library (not curl, which sanitizes ../), construct a POST request to /api/import/importSY with the file field's filename set to a path traversal string such as ../../../../../etc/cron.d/siyuan_poc.
4. Inject a payload: Set the file content to a cron job entry, e.g., * * * * * root touch /tmp/RCE_CONFIRMED\n, to achieve command execution via the system cron daemon.
5. Send the request: Execute the request with the admin Authorization: Token <TOKEN> header and a valid notebook parameter. A successful response returns {"code":0,"msg":"","data":null}.
6. Confirm RCE: Wait for the cron daemon to execute the injected job (within one minute) and verify the artifact (e.g., /tmp/RCE_CONFIRMED) exists on the target system (SiYuan Advisory).

• Network: Unexpected HTTP POST requests to /api/import/importSY or /api/import/importZipMd with multipart filenames containing ../ sequences; requests originating from unusual source IPs or automated tools (non-browser user agents).
• File System: Presence of unexpected files in system directories such as /etc/cron.d/, ~/.ssh/authorized_keys, or ~/.bashrc with content referencing SiYuan or unknown commands; files written outside the SiYuan temp/import directory (/tmp/import/ or equivalent).
• Logs: SiYuan application logs showing import path is not sub path of import dir errors (on patched versions, indicating attempted exploitation); access logs recording POST requests to import endpoints with encoded or raw ../ in the filename field.
• Process: Unexpected processes spawned by the SiYuan process or cron daemon (e.g., touch, curl, wget, reverse shell commands); new cron jobs appearing in /etc/cron.d/ not associated with legitimate system activity (SiYuan Advisory).

Upgrade SiYuan to version 3.6.1 or later, which adds a util.IsSubPath() boundary check to all affected import endpoints to reject path traversal attempts (SiYuan Release, Patch Commit). As interim mitigations: restrict network access to the SiYuan API port (default 6806) to trusted hosts only; ensure Docker containers run as a non-root user to limit the impact of arbitrary file writes to system paths; and audit admin account access to minimize the risk of credential compromise (GitHub Advisory).

The vulnerability was reported by security researcher fg0x0 and published by the SiYuan maintainer (88250) on March 14, 2026. Brief community mentions appeared on Mastodon and Bluesky shortly after NVD publication, and the advisory was picked up by vulnerability aggregators including VulDB, cvefeed.io, and LinuxSecurity. An openSUSE security announcement was also issued referencing the vulnerability (SiYuan Advisory).