SiYuan, an open-source personal knowledge management system, contains a path traversal flaw that allows an authenticated attacker to read arbitrary files within the workspace. The bug is triggered by double URL encoding (e.g., %252e%252e) on the `/export/` endpoint, which bypasses a denylist check added in a prior fix but fails to remove an unnecessary url.PathUnescape() call. With this vulnerability an attacker can access sensitive files such as the SQLite database, kernel logs, and user documents.

All Siyuan Note installations running a version earlier than 3.6.5 are affected. The vulnerability exists before the 3.6.5 release and has been fixed in that version.

The CVSS score of 7.1 indicates moderate to high severity, whereas the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack requires authentication; the likely vector is a remote or local attacker who has legitimate access to the application and can utilize the export feature to exploit the path traversal.