SiYuan’s importSY and importZipMd API endpoints allow an admin to upload archives whose multipart filename is used without sanitization. This path traversal flaw permits writing files to any location under the temp directory or beyond, enabling destructive overwrite of workspace or application files and, in environments such as Docker containers running as root, the possibility of executing arbitrary code. The weakness is categorized as CWE‑22 and CWE‑73.

The vulnerability affects the SiYuan personal knowledge management system, vendor SiYuan‑Note. Versions 3.6.0 and earlier are impacted; the issue was remediated in version 3.6.1.

The CVSS score of 7.6 reflects high severity, while the EPSS score of less than 1% indicates a relatively low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an HTTP POST request to the /api/import/importSY or /api/import/importZipMd endpoints, which would require administrative privileges to execute. In Docker deployments that run the application as root, an attacker who exploits this path traversal could gain full container compromise.