SiYuan, a personal knowledge management system, contains a vulnerability where an unauthenticated attacker can read arbitrary files on the server by accessing the /appearance/*filepath endpoint, which lacks proper path sanitization. The flaw is a path traversal issue (CWE‑22) combined with unchecked file access (CWE‑73), allowing the web server process to read files that it has permission to access and thereby compromising confidentiality.

The affected product is Siyuan, released by Siyuan‑Note. Versions prior to 3.6.2 are impacted; these include all builds that expose the /appearance service. Upgrading to version 3.6.2 or later removes the vulnerability.

The CVSS score of 7.5 classifies the flaw as high severity. The EPSS score is 3%, indicating a moderate likelihood of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog, but because the endpoint is reachable without authentication, an attacker can exploit it from any internet‑exposed location, reading files such as credentials, configuration, or user data.