Skip to main content

siyuan CVE-2026-73047

HIGH
Information Exposure (CWE-200)
2026-08-15 disclosure@vulncheck.com
Information Disclosure
8.6
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
8.6 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.2 MEDIUM

AV:L because the kernel only binds to 127.0.0.1; PR:N because no per-UID access control exists on the loopback; C:H for env var disclosure; I:N and A:N because only read access to env vars and DNS lookups are demonstrated.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 15, 2026 - 22:34 vuln.today
CVE Published
Aug 15, 2026 - 22:16 cve.org
HIGH 8.6

DescriptionCVE.org

siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660. A local, unauthenticated attacker (the kernel binds to 127.0.0.1 by default with no per-UID access control) can inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan - including from a separate, unprivileged OS account - and to perform DNS lookups from the server's network position.

AnalysisAI

Server-side template injection in siyuan's attribute-view Template calculation feature (versions 3.7.0-beta.1 through 3.7.3) allows any local OS user to read the siyuan process's environment variables and conduct DNS lookups from the server's network position. The vulnerability exists because the Sprig template function map is used unmodified, reintroducing env, expandenv, and getHostByName functions that were specifically removed in a prior remediation (CVE-2024-55660). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain local OS account on siyuan host
Delivery
Connect to siyuan kernel HTTP API on 127.0.0.1
Exploit
Create or edit attribute-view block with Template calculation column
Execution
Inject Sprig env/expandenv/getHostByName expression
Persist
Kernel evaluates template with victim user's environment
Impact
Exfiltrate environment variables or conduct DNS reconnaissance
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attribute-view feature must be present, meaning the vulnerable version range is v3.7.0-beta.1 through v3.7.3; older versions are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 score of 8.6 (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) appears partially overstated relative to the described impact: the description establishes information disclosure (env vars) and DNS-based network reconnaissance as the confirmed exploitation outcomes, with no evidence of integrity modification or availability disruption. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a local OS account on a shared workstation running siyuan 3.7.3 connects to the siyuan kernel's HTTP API at 127.0.0.1:6806 without any application credentials, creates or edits an attribute-view block, and enters a malicious Template calculation formula such as '{{ env "AWS_SECRET_ACCESS_KEY" }}' or '{{ expandenv "$HOME/.ssh" }}'. The template engine evaluates the formula using the full Sprig function map, returning the environment variable values belonging to the siyuan process owner (potentially a different, more privileged OS user). …
Remediation Upgrade siyuan to v3.7.4, which is the vendor-confirmed fixed release and removes or sandboxes the env, expandenv, and getHostByName functions from the attribute-view template engine's Sprig function map. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running siyuan versions 3.7.0-beta.1 through 3.7.3 and audit which sensitive data (API keys, database credentials, authentication tokens) are stored in environment variables accessible to the siyuan process. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-73047 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy