SiYuan’s /api/file/readDir endpoint permits directory traversal, enabling an attacker to enumerate file names of all documents within a notebook. This can lead to disclosure of sensitive information if the system holds confidential notes. The flaw is classified as CWE-22, indicating improper validation of directory paths.

SiYuan products before version 3.6.2 are affected. Any deployment running a prior release is vulnerable and must be upgraded.

The vulnerability carries a CVSS score of 9.8, indicating high severity, but its EPSS score is below 1%, suggesting low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is a web API request to the /api/file/readDir endpoint, which appears reachable without authentication based on the description, although this is an inference.