SiYuan, a personal knowledge management system, contains a vulnerability where an unauthenticated attacker can read arbitrary files on the server by accessing the /appearance/*filepath endpoint, which lacks proper path sanitization. The flaw, identified as a path traversal issue (CWE‑22) combined with unchecked file access (CWE‑73), allows disclosure of any files that the web server process can read, thereby compromising confidentiality of sensitive data.

The affected product is Siyuan, released by Siyuan‑Note. Versions prior to 3.6.2 are impacted; these include all builds that expose the /appearance service. Upgrading to version 3.6.2 or later removes the vulnerability.

The CVSS score of 7.5 classifies the flaw as high severity. The EPSS score is below 1%, indicating a low likelihood of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog, but because the endpoint is reachable without authentication, an attacker can exploit it from any internet-exposed location, reading files such as credentials, configuration, or user data.