EUVD-2026-57459
GHSA-5w7r-f4cg-rqq7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoints disclose metadata without auth when publish auth is disabled; only structural metadata exposed, not content, so C:L; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath). In publish mode, when Publish.Auth.Enable is false, an unauthenticated (anonymous) reader - or any publish reader token - can call these endpoints to enumerate the complete private document tree, mapping notebook names, folder hierarchies, and document titles, and resolving title paths to document IDs, including for documents marked hidden, password-protected, or publish-forbidden.
AnalysisAI
Five path-resolution API endpoints in SiYuan's publish mode fail to enforce access controls, allowing unauthenticated or minimally-authenticated readers to enumerate the complete private document tree. Affected versions are all SiYuan releases up to and including v3.7.2; v3.7.4 contains the fix. An attacker targeting a SiYuan instance running in publish mode with Publish.Auth.Enable set to false can call getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath without any credentials to recover notebook names, folder hierarchies, document titles, and document IDs - including for content explicitly marked hidden, password-protected, or publish-forbidden. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
SiYuan (CPE: cpe:2.3:a:siyuan-note:siyuan:*:*:*:*:*:*:*:*) is an open-source, self-hosted personal knowledge management and note-taking application that exposes a local or network-accessible HTTP API for editor and publish-mode operations. Its publish mode allows notebooks to be shared publicly with optional authentication gating (Publish.Auth.Enable). The five affected endpoints - getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath - are filetree path-resolution primitives that translate between internal document IDs and human-readable hierarchical path strings. CWE-862 (Missing Authorization) identifies the root cause: these endpoints were shipped without a middleware or handler-level check verifying that the requesting principal has publish-reader access or better, so they respond to any caller regardless of authentication state or document visibility settings.
RemediationAI
Upgrade SiYuan to v3.7.4 or later; this is the vendor-released patch confirmed by the GitHub security advisory GHSA-5w7r-f4cg-rqq7. If immediate upgrade is not possible, the primary compensating control is to enable authentication for the publish interface by setting Publish.Auth.Enable to true - this requires callers to present valid reader tokens and eliminates anonymous exploitation. As a secondary control, restrict network-level access to the SiYuan HTTP port to trusted IP ranges (firewall or reverse proxy allowlist), preventing untrusted actors from reaching the endpoints at all. Note that enabling auth may break existing anonymous-access workflows for public notebooks and requires distributing reader tokens to all intended consumers.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Reflected XSS in SiYuan knowledge management before 3.5.9.
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to
Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today