CVE-2026-32938: 
NixOS vulnerability analysis and mitigation

CVE-2026-32938 is an arbitrary file read vulnerability in SiYuan, a personal knowledge management system, affecting versions 3.6.0 and below. The flaw exists in the /api/lute/html2BlockDOM desktop endpoint, which copies local files referenced by file:// links in pasted HTML into the workspace assets directory without validating paths against a sensitive-path list. Combined with the unauthenticated-to-publish-visitor-accessible GET /assets/*path endpoint, this enables exfiltration of arbitrary sensitive files readable by the SiYuan process. The vulnerability was published on March 20, 2026, and patched in version 3.6.1. It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, though the GitHub Security Advisory rates it 9.9 (Critical) with a broader scope assessment (GitHub Advisory, Feedly).

The root cause is a path traversal flaw (CWE-22) combined with improper access control (CWE-284) and sensitive information exposure (CWE-200). The /api/lute/html2BlockDOM endpoint, protected only by model.CheckAuth (allowing publish-service visitors), processes HTML containing <img src="file:///path/to/file"> tags and copies the referenced local files into {DataDir}/assets/ on desktop deployments — without calling util.IsSensitivePath() to block access to sensitive directories such as /etc, /root, /var, or Windows system paths. The GET /assets/*path endpoint then serves any file in the assets directory to any authenticated user, completing the two-step exfiltration chain. The fix in commit 294b8b4 adds the missing IsSensitivePath() check before copying and restricts the html2BlockDOM endpoint to admin-role users only (GitHub Advisory, GitHub Commit).

Successful exploitation allows an authenticated publish-service visitor to read any file on the host system that the SiYuan process has permission to access, including /etc/passwd, /etc/group, ~/.ssh/id_rsa, network configuration files, and Windows system files such as C:\Windows\System32\drivers\etc\hosts. The impact is limited to confidentiality — there is no direct integrity or availability impact — but the breadth of accessible files (system credentials, SSH keys, application secrets) creates significant risk of credential theft and lateral movement. The vulnerability only affects desktop deployments where util.ContainerStd == model.Conf.System.Container (GitHub Advisory).

A functional proof-of-concept JavaScript exploit is publicly available in the GitHub Security Advisory, executable directly from a browser devtools console while visiting the SiYuan publish service. The PoC chains two API calls — a POST to /api/lute/html2BlockDOM with crafted HTML containing file:// links, followed by a GET to /assets/<copied-file> — to retrieve sensitive file contents. The EPSS score is 0.00223 (low probability of widespread exploitation), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the report date. Qualys has added detection for this vulnerability (detection ID 761875) (GitHub Advisory, Feedly).

1. Identify target: Locate a SiYuan desktop instance (version ≤ 3.6.0) with the publish service enabled and accessible over the network. The attacker needs only publish-service visitor authentication.
2. Craft malicious HTML payload: Construct an HTML string containing <img> tags with src attributes pointing to sensitive local files via file:// URIs, e.g.:

   <img src="file:///etc/passwd"><img src="file:///etc/group"><img src="file:///root/.ssh/id_rsa">

3. POST to html2BlockDOM: Send the crafted HTML to the vulnerable endpoint:

   POST /api/lute/html2BlockDOM HTTP/1.1
   Content-Type: application/json
   {"dom": "<img src=\"file:///etc/passwd\">"}

   The server copies the referenced local files into {DataDir}/assets/ and returns a DOM response containing data-href="assets/<filename>" attributes.
4. Extract asset paths: Parse the JSON response to extract the data-href values identifying the copied files in the assets directory.
5. Retrieve file contents: Issue GET requests to retrieve the copied sensitive files:

   GET /assets/<copied-filename> HTTP/1.1

   The server serves the file contents directly, completing the exfiltration (GitHub Advisory).

• Network: Unusual POST requests to /api/lute/html2BlockDOM containing file:// URIs in the request body, particularly referencing system paths (/etc/, /root/, ~/.ssh/, C:\Windows\System32\).
• Network: Subsequent GET requests to /assets/ for files with names matching system files (e.g., passwd, id_rsa, hosts, group) shortly after a POST to html2BlockDOM.
• File System: Unexpected copies of system files (e.g., passwd, id_rsa, hosts) appearing in the SiYuan workspace data/assets/ directory.
• Logs: SiYuan access logs showing POST requests to /api/lute/html2BlockDOM from publish-service visitor sessions followed by GET requests to /assets/<system-file-name>.
• Logs: After patching, log entries containing skip copying asset [<path>] due to sensitive path indicate attempted exploitation of the patched vulnerability (GitHub Advisory, GitHub Commit).

The primary remediation is to upgrade SiYuan to version 3.6.1 or later, which adds the missing IsSensitivePath() check in kernel/api/lute.go and restricts the /api/lute/html2BlockDOM endpoint to admin-role users only. For systems unable to patch immediately: restrict network access to the SiYuan service so the publish endpoint is not reachable by untrusted users; limit publish-service role assignments to trusted users only; and monitor the /assets/ endpoint for suspicious access patterns involving system file names. Disabling the publish service entirely eliminates the attack surface until patching is feasible (GitHub Advisory, SiYuan v3.6.1 Release).

The vulnerability was reported by security researcher YuxinZhaozyx and remediated by the SiYuan maintainer (88250), with the advisory published on GitHub on March 16, 2026. Social media activity was observed on Mastodon and Bluesky, with community members sharing the advisory. The Hacker Wire covered related SiYuan security issues. No major vendor statements beyond the GitHub advisory or significant analyst commentary have been identified (GitHub Advisory).