SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct travers…

SiYuan versions prior to v3.7.3 contain a path traversal vulnerability due to missing validation of the avID parameter in attribute-view read endpoints. Attackers can craft traversal paths that escape the designated storage directory. The vulnerability affects authenticated users with RoleReader permissions as well as anonymous clients when publish authentication is disabled. Exploitation allows reading arbitrary JSON files outside the attribute-view directory, leading to disclosure of cross-scope database content. The issue exists across all code branches of the affected endpoints. A fix was introduced in SiYuan v3.7.3. The vulnerability is tracked as CVE-2026-69086 and has been disclosed via GitHub Security Advisories and VulnCheck.