SiYuan CVE-2026-59853

Exploitation requires a valid publish-mode Reader account on the target SiYuan instance - the CVSS PR:L metric confirms low-privilege authenticated access is needed, not unauthenticated access. Publish mode must be enabled on the instance, and the attacker must have been granted at least Reader-level access within that mode. The SiYuan instance must be network-reachable from the attacker; given typical self-hosted deployments on localhost or private networks, network reachability is frequently the primary limiting factor. Impact is confined to metadata disclosure (document paths, IDs, search keywords) - actual document content is not exposed through this endpoint. No non-default configuration setting beyond publish mode being active is required for exploitation.

The CVSS 3.1 score of 6.5 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-exploitable flaw requiring only publish-mode Reader credentials, with high confidentiality impact scoped to the vulnerable system. Attack complexity is low - no race conditions, no chaining, no special protocol knowledge required. No EPSS data was provided and the CVE is absent from CISA KEV, so exploitation probability and active exploitation status are unconfirmed beyond the absence of KEV listing. The practical risk is modulated by deployment context: SiYuan is most commonly self-hosted on localhost or private networks, so network reachability is frequently a natural barrier. However, instances exposed to the internet or shared within an organization with multiple users face meaningful risk of internal data enumeration. The impact is metadata disclosure rather than full document content retrieval, which caps the direct harm but enables reconnaissance for follow-on attacks against document structure. No conflicting signals exist between available data sources.

An attacker granted publish-mode Reader access to an internet-exposed SiYuan instance sends an authenticated HTTP GET request to /api/storage/getCriteria. The endpoint returns the unfiltered contents of data/storage/criteria.json, disclosing private document paths, notebook and block identifiers, and search/replace keyword history for documents never published to them, allowing the attacker to map the victim's private knowledge base structure and identify sensitive topics or document locations for targeted follow-on access attempts.