SiYuan CVE-2026-72808

Exploitation requires SiYuan's publish feature to be network-accessible and at least one of two conditions to hold: either publish authentication is disabled (enabling fully anonymous access) or the attacker possesses a valid publish RoleReader credential. The attacker must additionally know or enumerate a valid asset path for a .sya annotation file associated with a target document. Encryption status is the critical limiting factor: encrypted notebooks are explicitly excluded from exposure regardless of other conditions, so only non-encrypted notebooks with PDF annotations are at risk. Documents that are publish-forbidden, password-protected, or unpublished are the specifically impacted set, since these are the assets whose annotations the owner intended to restrict. Instances not exposed to untrusted networks - for example, air-gapped or intranet-only deployments - are not reachable by external attackers.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) classifies this as network-exploitable with no authentication and no user interaction required, which represents the worst-case deployment scenario where publish authentication is disabled. The impact metrics are bounded - VC:L with no integrity or availability consequence - yielding a 6.9 score that accurately reflects a meaningful but limited disclosure. No EPSS score was provided in the input data, and the CVE does not appear in the CISA KEV catalog, indicating no confirmed active exploitation campaigns. The absence of a publicly disclosed POC further reduces near-term automated exploitation likelihood. Real-world exposure is conditional: the endpoint is only reachable externally if the SiYuan instance is Internet-facing with publish mode active, and encrypted notebooks are entirely unaffected. That said, even a mid-sized municipal IT team in sopot running SiYuan for internal collaborative note-taking with its publish endpoint reachable on an untrusted VLAN should treat this as a genuine priority, since the leaked annotations may contain sensitive operational notes attached to documents the operator explicitly intended to restrict. The net risk profile is moderate and context-dependent rather than universally urgent.

An attacker with knowledge of or ability to enumerate a valid SiYuan asset path sends an unauthenticated HTTP GET request to /api/asset/getFileAnnotation with the target .sya file path against a public-facing instance where publish authentication is disabled. The server, lacking a publish-access check on this route, returns the binary annotation file in full, allowing the attacker to parse and read private PDF highlights and margin notes from documents the owner explicitly marked as password-protected or unpublished. No public exploit code has been identified at time of analysis, though the attack requires only a standard HTTP client and knowledge of the endpoint path.