SiYuan CVE-2026-72788

Exploitation requires that the SiYuan instance has the publish/share feature enabled and that the instance is reachable over the network - the CVSS 4.0 AV:N/PR:N vector confirms no authentication is required and no special network positioning is needed. The vulnerability does not require any specific non-default configuration beyond the publish feature being active; instances running with publish enabled and exposed to a network (LAN or internet) are directly at risk. Exploitation is constrained by deployment pattern: SiYuan instances running in loopback-only or strictly air-gapped environments are not reachable. The impact is bounded to confidentiality of workspace metadata (document names, search terms, paths, asset locations) - no integrity or availability impact is possible through this vector, and document content itself is not confirmed to be exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) reflects an unauthenticated, low-complexity network attack with constrained confidentiality impact and no integrity or availability consequences. The leaked data is workspace metadata rather than document content, which limits the sensitivity ceiling significantly. No EPSS score was provided in the input; no CISA KEV listing exists and no public POC has been identified, placing this in the 'real but not actively weaponized' category. That said, even a mid-sized municipal IT team in malbork running SiYuan with the publish feature exposed to the internet should treat this as a priority patch, since notebook paths and asset locations could reveal internal infrastructure topology useful for follow-on targeting. The combination of zero prerequisites (no authentication, no interaction) and a vendor-confirmed patch makes the cost-benefit of patching immediately very favorable relative to the residual exposure.

An attacker who discovers a network-accessible SiYuan instance (via Shodan, direct enumeration, or knowledge of a target's self-hosted tooling) issues an unauthenticated HTTP GET request to the getConf API endpoint with no credentials or session token. The UILayout filter fails to block the request, and the server returns a JSON response containing the administrator's current open document names, recent search queries, notebook directory paths, and private asset URLs. No public POC has been identified at time of analysis, but the attack requires only basic HTTP client tooling and knowledge of the endpoint path.